threatmon.io Open in urlscan Pro
143.244.210.238  Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&e_ipv6=AQI30hUdEb2qRwAAAZFMWK9Wee627WvtgZ5gwTqNisdGmyFecAE9gK6aQvGoRumx4sI6gA

Request Chain 72

• https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=335575774567&containerType=EMBEDDED&portalId=45734016&audienceId=null&pageUrl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&pageTitle=AzzaSec+Ransomware+Technical+Malware+Analysis+Report+%7C+ThreatMon&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F127.0.0.0+Safari%2F537.36 HTTP 307
• https://static.hubspot.com/img/trackers/blank001.gif HTTP 301
• https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

Request Chain 86

• https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=352884807570&containerType=BANNER&portalId=45734016&audienceId=null&campaignId=a9e7c9f7-9283-4319-8446-b3158f95a8d0&isLoaded=true&pageUrl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&pageTitle=AzzaSec+Ransomware+Technical+Malware+Analysis+Report+%7C+ThreatMon&userAgent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F127.0.0.0+Safari%2F537.36&hutk=1816cf8546d4410363dc1c65140f18e7&hssc=205617164.1.1723562767909&hstc=205617164.1816cf8546d4410363dc1c65140f18e7.1723562767909.1723562767909.1723562767909.1&hsfp=872352201 HTTP 307
• https://static.hubspot.com/img/trackers/blank001.gif HTTP 301
• https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif

88 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response threatmon.io/azzasec-ransomware-technical-malware-analysis-report/	776 KB 99 KB	860ms 472ms	Document text/html	143.244.210.238 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.244.210.238 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash 2f77345913c9d5b5f394b1df3b902624c0efadae869fe88fa4259d32cafa7c44 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Cache-Control no-cache, private Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Tue, 13 Aug 2024 15:26:04 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-XSS-Protection 1; mode=block
GET H2	200	css2 fonts.googleapis.com/	28 KB 2 KB	125ms 46ms	Stylesheet text/css	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Kumbh+Sans:wght@100;300;400;500;600;700;800;900&display=swap Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 88e4ef9f209494344bba7f8cd266389b4ca1b292046e7f14b12b83dae1921d0c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 13 Aug 2024 15:26:05 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 13 Aug 2024 15:26:05 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 13 Aug 2024 15:26:05 GMT
GET H2	200	45734016.js Show response js.hs-scripts.com/	2 KB 1 KB	435ms 371ms	Script application/javascript	2606:4700::6810:8ad1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/45734016.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8ad1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 032183090a38f05a4259a3b50e6a39449d55faebc9adcd9eb65504a986657b74 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 60b408d0-3728-4585-9e9a-5d4b4b34d0eb x-envoy-upstream-service-time 15 content-length 682 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 60b408d0-3728-4585-9e9a-5d4b4b34d0eb last-modified Tue, 13 Aug 2024 15:26:05 GMT server cloudflare vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://threatmon.io x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-78c8468c8b-9d6fc access-control-allow-credentials true cache-control public, max-age=90 accept-ranges bytes cf-ray 8b29b8b33b480e46-MXP expires Tue, 13 Aug 2024 15:27:35 GMT
GET H3	200	v2.js Show response js.hsforms.net/forms/embed/	483 KB 156 KB	79ms 42ms	Script application/javascript	104.18.142.119 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsforms.net/forms/embed/v2.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.142.119 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dfdf1af1a230e3ee08968606c4322f5a9c51a5a6bf341687fedac60716c9ddab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-encoding gzip age 55 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5781/bundles/project-v2.js&cfRay=8af9b11cdedc83ac-MXP x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"07033d485ccfcdda144e7a4173dbc0bc" vary accept-encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.5781/bundles/project-v2.js date Tue, 13 Aug 2024 15:26:05 GMT via 1.1 9d2dee9b44718f249b789987d2cbe62c.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-version-id __TkXxzKt.v8sm6CVT1EUR2QdTtEmM_4 cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 5ed8fb6b-ecb4-4b85-946d-2a592ea1bf93 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 5ed8fb6b-ecb4-4b85-946d-2a592ea1bf93 last-modified Wed, 07 Aug 2024 13:25:19 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AXbzwhGFba9Q320PW06uCoJ7Ljfks6PYvsNCV%2Bd8MKv2U4%2Bm%2BFuw9FOaXx65rWQMQEPb8wuSbtEjzfJibRRDF6MSWjPNxgPMB6CyEHh8lbuYVYa2Gw4JVVAl3yroY1BR"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-5f4dcb8bc8-vjwjs cf-ray 8b29b8b30c655234-MXP x-amz-cf-id vgAbudLFFwkhDoFKvfvTnH8o9QAoySu2meWuExcUqHQGW2d1n5h_Sg==
GET H2	200	logo-white.svg threatmon.b-cdn.net/assets/images/	6 KB 3 KB	149ms 49ms	Image image/svg+xml	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.b-cdn.net/assets/images/logo-white.svg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 4acb55fc91355697db2a5e1678f30a2000156b8ec9abc9b37a2f343c0a65a115 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1079 cdn-cachedat 03/27/2024 00:01:56 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Wed, 17 May 2023 13:21:08 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"6464d4c4-186a" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid a4a63f54847799849af2283e42b80dce cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	logo-black.svg threatmon.b-cdn.net/assets/images/	6 KB 3 KB	154ms 54ms	Image image/svg+xml	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.b-cdn.net/assets/images/logo-black.svg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 165ca997757f184a51a04831c370dcb049fd9aa740e36072faafc4519848fda9 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1082 cdn-cachedat 10/02/2023 16:02:15 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Wed, 17 May 2023 13:20:48 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"6464d4b0-18cc" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 77ca82e12f1d3d85f0897c1005753777 cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	no-image.png threatmon.b-cdn.net/assets/images/	68 B 556 B	119ms 119ms	Image image/png	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.b-cdn.net/assets/images/no-image.png Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash eba7a7a39459c37cc784afeb2ef1613d0b046b4e1988984fd2f801b568cb7a08 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT x-content-type-options nosniff cdn-edgestorageid 1082 cdn-cachedat 10/02/2023 16:02:15 cdn-pullzone 1606769 content-length 68 x-xss-protection 1; mode=block last-modified Thu, 25 May 2023 17:30:22 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag "646f9b2e-44" x-frame-options SAMEORIGIN content-type image/png cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid a5f543e555f74e527af12652717a7079 accept-ranges bytes cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H/1.1	200 OK	azzasec-ransomware-technical-malware-analysis-report.jpg threatmon.io/storage/183/	34 KB 35 KB	185ms 185ms	Image image/jpeg	143.244.210.238 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.io/storage/183/azzasec-ransomware-technical-malware-analysis-report.jpg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.244.210.238 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash a8f52e6bc2e8c95eeebe218170f6cf869d43f453f208b3e88f49630c82c44dcc Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Tue, 13 Aug 2024 15:26:05 GMT X-Content-Type-Options nosniff Last-Modified Mon, 29 Jul 2024 16:39:25 GMT Server nginx/1.18.0 (Ubuntu) ETag "66a7c5bd-8929" X-Frame-Options SAMEORIGIN Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 35113 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	free-trial.jpeg threatmon.io/assets/images/	36 KB 36 KB	372ms 184ms	Image image/jpeg	143.244.210.238 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.io/assets/images/free-trial.jpeg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.244.210.238 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash 21560f06331ab6009b5530cd899c9acaa88dc932ef3e4554ec4ad8f9c4c5f654 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Tue, 13 Aug 2024 15:26:05 GMT X-Content-Type-Options nosniff Last-Modified Mon, 18 Sep 2023 11:05:51 GMT Server nginx/1.18.0 (Ubuntu) ETag "65082f0f-9088" X-Frame-Options SAMEORIGIN Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 37000 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	youtube.png threatmon.io/assets/images/	129 KB 130 KB	704ms 381ms	Image image/png	143.244.210.238 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.io/assets/images/youtube.png Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.244.210.238 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash 9f5413f764cdf9655b7b61685494a57616c098d050ab11f9c404904296558b03 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Tue, 13 Aug 2024 15:26:05 GMT X-Content-Type-Options nosniff Last-Modified Sat, 04 Nov 2023 17:09:22 GMT Server nginx/1.18.0 (Ubuntu) ETag "65467ac2-205c4" X-Frame-Options SAMEORIGIN Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 132548 X-XSS-Protection 1; mode=block
GET H2	200	jquery-3.6.0.js Show response threatmon.b-cdn.net/assets/js/	87 KB 33 KB	121ms 118ms	Script application/javascript	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/js/jquery-3.6.0.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 9ae1295c0374a41019c2ef260cdc7c70beaf72b01dba451ebcddca0e38b68545 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1081 cdn-cachedat 04/17/2024 00:52:17 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Fri, 18 Aug 2023 11:28:07 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"64df55c7-15b4b" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid ad77ce466340fad52394d40381dcdad4 cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H3	200	jquery-ui.min.js Show response cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/	249 KB 56 KB	79ms 49ms	Script application/javascript	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.13.2/jquery-ui.min.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 418668 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 56990 last-modified Fri, 29 Jul 2022 20:40:53 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "62e445d5-de9e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PfPRPgs8udTUQma9a%2FE1HUih5SXnRfBnjaFwkg7lpvko9y0%2BoSHrr0R2cR04%2BoMBrvTodLYMnLGvZS19D2L3QoSX8%2BQp1mTTsIVOuye4Y8CWNhxDacYfHhWj7TV1QCtA%2ByBUp7rH"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8b29b8b4589683af-MXP expires Sun, 03 Aug 2025 15:26:05 GMT
GET H2	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/	78 KB 24 KB	80ms 23ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/bootstrap.bundle.min.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c0c09020adb6f602b16d48374166b9e38ca92383a81650b6a9097c43cc43f31f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 13 Aug 2024 15:26:05 GMT x-content-type-options nosniff content-encoding br age 4872263 x-jsd-version 5.2.0 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 24474 x-served-by cache-fra-eddf8230139-FRA, cache-mxp6955-MXP x-jsd-version-type version etag W/"137ae-xmO6oFGFa2TXRmKalh4ju/D7r4w" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	lazyload.min.js Show response threatmon.b-cdn.net/assets/js/	2 KB 2 KB	119ms 118ms	Script application/javascript	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/js/lazyload.min.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 15b71d88d2d6384192cdf752343e3a7635f9aef380f4d6425ac93c6270390388 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1081 cdn-cachedat 10/02/2023 16:14:55 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Tue, 09 May 2023 16:22:12 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"645a7334-989" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 6553100aa70efe35eaeafaab460c75cb cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	sitenav.js Show response threatmon.b-cdn.net/assets/js/	20 KB 4 KB	120ms 118ms	Script application/javascript	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/js/sitenav.js?v=1.3.8 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 9923ebc4fe2706f271e6c20b61d919183d07d1c246bad99137e6c42dd604af8d Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1081 cdn-cachedat 10/02/2023 16:14:55 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Thu, 08 Jun 2023 18:42:16 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"64822108-51de" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid cf3021a03ae0adc6b585e8910cb5f453 cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	custom.js Show response threatmon.b-cdn.net/assets/js/	904 B 946 B	119ms 117ms	Script application/javascript	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/js/custom.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash c47e1070a6f5361981b3ce04bdf7594c9057186b9af8b5f4bf1890cef8821bec Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1079 cdn-cachedat 03/26/2024 21:05:40 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Thu, 25 May 2023 17:34:00 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"646f9c08-388" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid d3e06891c30d78ae963f8a5bddacad4c cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	BusinessEmailValidtor.js Show response threatmon.b-cdn.net/assets/js/	3 MB 953 KB	56ms 54ms	Script application/javascript	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/js/BusinessEmailValidtor.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash deabff59396bb30a58d4d4219acf3bcdb5b7884a6059dd5b7302127bb5b7dbfe Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1081 cdn-cachedat 10/02/2023 16:14:55 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Wed, 02 Aug 2023 11:22:11 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"64ca3c63-33968d" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 524d828a0eddf96db4b8e1ee7dec7a44 cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	downloadform.js Show response threatmon.b-cdn.net/assets/js/	6 KB 2 KB	120ms 119ms	Script application/javascript	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/js/downloadform.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 3df8547a50cac09d88df316ddb730537720f54b8e3c4bc2365102439facf2143 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1081 cdn-cachedat 06/28/2024 08:24:26 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Wed, 02 Aug 2023 11:22:11 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"64ca3c63-1947" vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 3465f26c60f0060e6800804a38b33e7e cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	swiper-bundle.min.js Show response cdn.jsdelivr.net/npm/swiper@9/	137 KB 41 KB	80ms 24ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/swiper@9/swiper-bundle.min.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 13 Aug 2024 15:26:05 GMT x-content-type-options nosniff content-encoding br age 37781 x-jsd-version 9.4.1 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 41184 x-served-by cache-fra-eddf8230106-FRA, cache-mxp6923-MXP x-jsd-version-type version etag W/"22512-6lnzeyMttt7iaUB4vyHhU6CbrN0" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=604800, s-maxage=43200 accept-ranges bytes timing-allow-origin *
GET H2	200	simple-notify.min.js Show response cdn.jsdelivr.net/npm/simple-notify@0.5.2/dist/	12 KB 3 KB	105ms 48ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/simple-notify@0.5.2/dist/simple-notify.min.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 466050065488e75cc4db765439cc8e6ad81a40595b938e06f6f0a41b536a3849 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 13 Aug 2024 15:26:05 GMT x-content-type-options nosniff content-encoding br age 1080057 x-jsd-version 0.5.2 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 3359 x-served-by cache-fra-eddf8230063-FRA, cache-mxp6923-MXP x-jsd-version-type version etag W/"2e20-8glGGOMi9xLFfFAP2dQGJY32cyg" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	simple-notify.min.css cdn.jsdelivr.net/npm/simple-notify@0.5.2/dist/	4 KB 1 KB	106ms 50ms	Stylesheet text/css	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/simple-notify@0.5.2/dist/simple-notify.min.css Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3ead2c39c8a8e07c7a2c8562d26a19c451b6ec9ddb65e9dfc11b5f34fd652ce3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 13 Aug 2024 15:26:05 GMT x-content-type-options nosniff content-encoding br age 1585332 x-jsd-version 0.5.2 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 1179 x-served-by cache-fra-etou8220059-FRA, cache-mxp6923-MXP x-jsd-version-type version etag W/"102c-qFxPXn6EQkynzCDG3ZP1w67wNkY" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 31 KB	75ms 24ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1580510 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 30875 x-served-by cache-lga21931-LGA, cache-mxp6958-MXP last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1723562766.515659,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 93803, 297894
GET H2	200	gtm.js Show response www.googletagmanager.com/	290 KB 102 KB	131ms 52ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-KQ3MTKR Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7fdd48bd23e44edd2b73d1a7f6540448a6dec313b21bf7c43190ce49e03f7e97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 103711 x-xss-protection 0 last-modified Tue, 13 Aug 2024 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 13 Aug 2024 15:26:05 GMT
GET H2	200	hotjar-3924147.js Show response static.hotjar.com/c/	11 KB 5 KB	183ms 81ms	Script application/javascript	18.66.102.51 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3924147.js?sv=6 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.102.51 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-102-51.fra56.r.cloudfront.net Software / Resource Hash 2400e10edcd48e2297e21bf03bfa5623a7209d6f87c366a6c9502c5aaf755976 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=2592000; includeSubDomains content-encoding br x-content-type-options nosniff date Tue, 13 Aug 2024 15:26:05 GMT via 1.1 c387974a86541bbcc6c5141a85eeaf36.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P2 etag W/0b889cfe764e9a642835cde918b37b83 vary Accept-Encoding x-cache RefreshHit from cloudfront content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-cache-hit 1 cache-control max-age=60 cross-origin-resource-policy cross-origin x-amz-cf-id pPrwI4V_0qFcCi_AIuMZc6lSfRSRbPXV_RWZ-o1xyxtvXird21acsw==
GET H3	404	json Show response forms.hsforms.com/embed/v3/form/45734016/ce0e9426-9e5d-4856-bada-86f5ae2d4489/	104 B 1 KB	337ms 296ms	XHR application/json	104.18.80.204 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hsforms.com/embed/v3/form/45734016/ce0e9426-9e5d-4856-bada-86f5ae2d4489/json?hs_static_app=forms-embed&hs_static_app_version=1.5781&X-HubSpot-Static-App-Info=forms-embed-1.5781 Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/embed/v2.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 801a8dae1eabaa2a30e05d6fcfef1d1de9e9d76d28907f4727eaf2949fd01371 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers x-origin-hublet na1 date Tue, 13 Aug 2024 15:26:05 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0d990e68-6d0e-4897-8bcc-851c962a7a71 x-envoy-upstream-service-time 150 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0d990e68-6d0e-4897-8bcc-851c962a7a71 server cloudflare vary origin access-control-allow-methods OPTIONS, GET x-hubspot-notfound true access-control-allow-origin https://threatmon.io x-evy-trace-virtual-host all content-type application/json;charset=utf-8 access-control-max-age 180 access-control-allow-credentials false access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 8b29b8b469270e8d-MXP x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-c957v
GET H/1.1	200 OK	reb2b.js.gz Show response s3-us-west-2.amazonaws.com/b2bjsstore/b/YE63P0HM2VOW/	19 KB 5 KB	659ms 260ms	Script application/javascript	52.218.216.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/b2bjsstore/b/YE63P0HM2VOW/reb2b.js.gz Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.218.216.144 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 95b01041393f9b01984be169b0471a4389e300c9c95a2e6183cdd62ece1f5fe7 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Tue, 13 Aug 2024 15:26:07 GMT Content-Encoding gzip Last-Modified Wed, 12 Jun 2024 21:38:42 GMT Server AmazonS3 x-amz-request-id 3AYP1QG49WC84KK5 ETag "438d746a78637b7d438318904814d741" x-amz-server-side-encryption AES256 Content-Type application/javascript Cache-Control max-age=172800 Accept-Ranges bytes Content-Length 4980 x-amz-id-2 PsMyV9YpFh9cPnjXII0s771BeWvAsIbvxW9ugOSUI01J9Sy6DwrR/Gdfic0IGzT6W5U7cRH7TDM= Expires Fri, 14 Jun 2024 21:38:41 GMT
GET DATA	200 OK	truncated /	291 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3d4269c55637726f0bf2e8ec7f7e0b9a2e2f5ec5ebf121155073c8f2ed3ceb05 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	video-bg.jpg threatmon.b-cdn.net/assets/images/	52 KB 53 KB	110ms 110ms	Image image/jpeg	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.b-cdn.net/assets/images/video-bg.jpg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 06b64c55cd5e228abf81b5a3f3b99a4787f48f8beed111288bd4c880bdb239b3 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT x-content-type-options nosniff cdn-edgestorageid 1080 cdn-cachedat 10/02/2023 19:35:38 cdn-pullzone 1606769 content-length 53479 x-xss-protection 1; mode=block last-modified Fri, 02 Jun 2023 18:26:14 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag "647a3446-d0e7" x-frame-options SAMEORIGIN content-type image/jpeg cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 10a768d9b99587e9b12033c7d0bb41d8 accept-ranges bytes cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	c4mw1n92AsfhuCq6tVsaoIx1LQICk0boNoq0ShNPVo0.woff2 fonts.gstatic.com/s/kumbhsans/v22/	29 KB 30 KB	110ms 34ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/kumbhsans/v22/c4mw1n92AsfhuCq6tVsaoIx1LQICk0boNoq0ShNPVo0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Kumbh+Sans:wght@100;300;400;500;600;700;800;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f8a754efdbc7fe7aae0e3fd79f2afb1f5a66dd0de46cfce359aa6a6bc5939db5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 14:28:40 GMT x-content-type-options nosniff age 3445 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 29776 x-xss-protection 0 last-modified Thu, 25 Jan 2024 21:29:07 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Aug 2025 14:28:40 GMT
GET H2	200	interactive-169543631444.png no-cache.hubspot.com/cta/default/45734016/	2 KB 3 KB	246ms 180ms	Image image/png	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://no-cache.hubspot.com/cta/default/45734016/interactive-169543631444.png Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d94e545c29b14d5f60f17a3be7638dc811753a422ceeb1d978fe102244325d3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT x-amz-version-id r5mxvnYdgNQm2epRlAso.73eadCRRoy1 cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-request-id SCC9P7NZP44849FY x-amz-server-side-encryption AES256 content-length 1720 x-amz-id-2 ItqI6uJ8J7U4ONdMb2C8XbdsUSDG8Ty472o/nD9sQShPK/nX/k7YD2j8QTXoUxKvEyoDlDUYF48= last-modified Sun, 14 Jul 2024 08:47:00 GMT server cloudflare etag "672441f62f19241430294d3088b55ec5" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axONtDtn7VJ3dW%2FF3mgBvwXqFBTdzDD%2FUH%2FNY5nzkj2jh1hyE5mz3y4sagQyFtBdI1Jd9LvlHLkilWBMx897QGWHYQYI9gzsTO9URg%2BbK%2FptfZeTxsy6Xoccz%2BxgIRbz%2BpDu%2FgNZKjszFoqZmCIv5qdE"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control no-cache, no-store accept-ranges bytes cf-ray 8b29b8b4aff70dfa-MXP
GET H3	200	json Show response forms.hsforms.com/embed/v3/form/45734016/976b5fae-fe8f-49b3-b6c0-dcafa13131dd/	15 KB 5 KB	377ms 358ms	XHR application/json	104.18.80.204 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hsforms.com/embed/v3/form/45734016/976b5fae-fe8f-49b3-b6c0-dcafa13131dd/json?hs_static_app=forms-embed&hs_static_app_version=1.5781&X-HubSpot-Static-App-Info=forms-embed-1.5781 Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/embed/v2.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3e3236efa535c41cfde06fab93aa781e81911cc137b87c3adc5da65b535dfb1c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers x-origin-hublet na1 date Tue, 13 Aug 2024 15:26:05 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 1348d38e-f0f9-42fe-8700-e22350d32f01 x-envoy-upstream-service-time 145 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 1348d38e-f0f9-42fe-8700-e22350d32f01 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://threatmon.io x-evy-trace-virtual-host all access-control-expose-headers X-Origin-Hublet access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store x-robots-tag none access-control-allow-headers * cf-ray 8b29b8b469250e8d-MXP x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-xz9v8
GET H/1.1	200 OK	report-icon.svg threatmon.io/assets/images/	1 KB 2 KB	401ms 185ms	Image image/svg+xml	143.244.210.238 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.io/assets/images/report-icon.svg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.244.210.238 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash eda7f038fc09cc03d6003459d89d148c3a7cfda78f6d5db7c599ff2e405770f8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Tue, 13 Aug 2024 15:26:05 GMT X-Content-Type-Options nosniff Last-Modified Fri, 26 May 2023 18:02:26 GMT Server nginx/1.18.0 (Ubuntu) ETag "6470f432-4f4" X-Frame-Options SAMEORIGIN Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 1268 X-XSS-Protection 1; mode=block
GET H/1.1	404 Not Found	icon-bg.png threatmon.io/images/	4 KB 4 KB	675ms 415ms	Image text/html	143.244.210.238 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.io/images/icon-bg.png Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.244.210.238 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash 370515ffdc49b36280c17785da54a4345b3089b89186b62247692d3e29156305 Request headers Referer https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT Cache-Control no-cache, private Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	69 KB 25 KB	285ms 225ms	Script application/javascript	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/45734016.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-encoding gzip x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.586/bundles/project.js&cfRay=8b214bd1ce5583bb-MXP x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"ac41634810840adc02ea51748cb19c2f" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset collected-forms-embed-js/static-1.586/bundles/project.js date Tue, 13 Aug 2024 15:26:05 GMT x-amz-version-id FCxgV_B3nWescR00el0uV0Hdj2lazDBZ x-content-type-options nosniff cf-cache-status EXPIRED via 1.1 a4f9ca051b97c1ac09e2af244690d376.cloudfront.net (CloudFront) x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 051414bb-f330-4d53-9fe5-d8e90ccbf18a x-cache Miss from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-envoy-upstream-service-time 37 x-evy-trace-route-configuration listener_https/all x-request-id 051414bb-f330-4d53-9fe5-d8e90ccbf18a last-modified Tue, 23 Jul 2024 12:55:20 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-5f4dcb8bc8-vjwjs cf-ray 8b29b8b5ec405242-MXP x-amz-cf-id Sc2D1Y5JCqTtsAGqEUPAnMjaTESQONrNLU_0TMtbfMxjVyve8lethg==
GET H2	200	web-interactives-embed.js Show response js.hubspot.com/	83 KB 24 KB	214ms 163ms	Script application/javascript	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hubspot.com/web-interactives-embed.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/45734016.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a58fb4ba57e791839c580c3ab186ee45d39e5558c62fa910a531e2225be9331 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-encoding gzip x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1347/bundles/project.js&cfRay=8b29b8b5dabd0f72-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"d5eb842cb627d3498b8eea8cb51bd4ba" vary accept-encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.1347/bundles/project.js date Tue, 13 Aug 2024 15:26:05 GMT via 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-version-id qlSsOogDzDfjHYWqoRnPM3MeITU5eHaq cf-cache-status EXPIRED nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id fa3814d4-867b-49ab-9cb2-d26ea7bee63a x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 0 x-evy-trace-route-configuration listener_https/all x-request-id fa3814d4-867b-49ab-9cb2-d26ea7bee63a last-modified Tue, 13 Aug 2024 14:43:57 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N5jP%2F831VvfjRMP3c6q0xXQM1FU46J72is9JbN9XHIjqXXHJncLtb5zvUfSQBXsc14OaIebtF8MoiEq%2Fw3HgsMLNSTpuJ2RaQ4LuP996TcUYkvnH2pa0Y6MQvCh1qfTyOb5b2nJwmOLQA2fj"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-5f4dcb8bc8-xgqk6 cf-ray 8b29b8b5dabd0f72-MXP x-amz-cf-id AIr9VLUeZ6DdYw63hkIVKPH3yWHKpMUlxwooWQUm0jojFgRsH9oqyg==
GET H2	200	banner.js Show response js.hs-banner.com/v2/45734016/	76 KB 28 KB	114ms 63ms	Script text/javascript	2606:4700::6812:17b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/45734016/banner.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/45734016.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 21255d3309d56265e92286f4303ab5818bc283d9d04d2f5e2b079487d8dcfea5 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT x-amz-version-id ZO2pD13eWJ7XYsNgPLzt0bigjQAIv_6b content-encoding gzip cf-cache-status HIT x-amz-request-id YBF7F4H0H1GCN6CX x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id f82e00e8-c988-4ceb-ad50-58386526bfdf x-envoy-upstream-service-time 100 x-amz-id-2 qKrHQ/o2bHMZ0+evPrvEr14YbQ9o44Si8FWXJOwt7jB6vZgXF3Khb5dwgvem96OuocwgNM822ex+3sRDOcQ8kg== x-evy-trace-listener listener_https x-request-id f82e00e8-c988-4ceb-ad50-58386526bfdf x-evy-trace-route-configuration listener_https/all last-modified Tue, 13 Aug 2024 12:21:22 GMT server cloudflare etag W/"16bf3244510cc3c9e9d299a23684e792" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://threatmon.io x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-g9d49 vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 8b29b8b5df504c3e-MXP expires Tue, 13 Aug 2024 15:30:05 GMT
GET H2	200	fb.js Show response js.hsadspixel.net/	6 KB 4 KB	97ms 37ms	Script application/javascript	2606:4700::6811:df98 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsadspixel.net/fb.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/45734016.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:df98 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e1b1a37caa8b7627123aeb0e23ad3a2ac14d4ad48be7aabb2ca7ca9da218ef5 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT x-amz-version-id UIOsIr3qFS9r3wFn4ECf3yNr1.R8N2aA content-encoding gzip x-content-type-options nosniff via 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront) cf-cache-status HIT x-amz-cf-pop IAD12-P3 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id cb1356a7-03fd-46e3-bd72-e3764bf3d50b content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.572/bundles/pixels-release.js&cfRay=8af1638708f3ba83-FRA x-cache Hit from cloudfront cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod age 483 x-envoy-upstream-service-time 0 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id cb1356a7-03fd-46e3-bd72-e3764bf3d50b last-modified Tue, 06 Aug 2024 19:11:03 UTC server cloudflare etag W/"45a803cc17701ff8c7710294960c14c7" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-5f4dcb8bc8-bhgvl cf-ray 8b29b8b638660df1-MXP x-amz-cf-id Ycecs5Gn1WB7Wbdg6E5xk-GmGBqu7mm699p2XzIx5QjXN76CqRqUug== x-hs-target-asset adsscriptloaderstatic/static-1.572/bundles/pixels-release.js
GET H2	200	45734016.js Show response js.hs-analytics.net/analytics/1723562700000/	68 KB 25 KB	141ms 86ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1723562700000/45734016.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/45734016.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1055f22e94b8680f2b9676f8be702f30306fd0ae370ecdbe18ed9f5871bc41f8 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT x-amz-version-id null content-encoding gzip cf-cache-status HIT x-amz-request-id JY6CJ18Y2AMT3Y95 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 276cb326-ac18-4d70-abda-b27681c92aaa x-envoy-upstream-service-time 20 x-amz-id-2 Afbbw47s649Uuui5I6tsdxz/ywysZQClEeJ1D2mgcSHiVH4BcRNQC5xsuUaTbV2NGpimeb6bmLs= x-evy-trace-listener listener_https x-request-id 276cb326-ac18-4d70-abda-b27681c92aaa x-evy-trace-route-configuration listener_https/all last-modified Tue, 13 Aug 2024 12:23:15 GMT server cloudflare etag W/"1bbd7f70caed3024cf94dc480b0276a5" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-g9d49 cache-control max-age=300,public access-control-allow-credentials false cf-ray 8b29b8b658e54c74-MXP expires Tue, 13 Aug 2024 15:30:05 GMT
GET H2	200	modules.8da33a8f469c3b5ffcec.js Show response script.hotjar.com/	223 KB 56 KB	151ms 47ms	Script application/javascript	13.227.219.71 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.8da33a8f469c3b5ffcec.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3924147.js?sv=6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.227.219.71 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-227-219-71.ams54.r.cloudfront.net Software / Resource Hash 76f448ec45359e863fb3a6432a2a3cf22c0cc0a52aead6318b57ab38db6f1d14 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 30 Jul 2024 14:23:06 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 b619a16f6f8fe9793bf642d2a8434284.cloudfront.net (CloudFront) x-amz-cf-pop AMS54-C1 age 1213379 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 56385 last-modified Tue, 30 Jul 2024 14:22:40 GMT etag "0728625a147ca79276a1790b9cf3175d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-robots-tag none x-amz-cf-id 1I1U852wXWWvg82reRccIqpFGj4CHrv0n0riozt-q6QTaRNYQR1dug==
GET H2	200	js Show response www.googletagmanager.com/gtag/	274 KB 94 KB	58ms 57ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-8N4N77BDJY&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQ3MTKR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b497f45cdc60402c9d927b5b0618e84b1f437d08224b1143657dc7ce426ca452 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 96636 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 13 Aug 2024 15:26:05 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	138ms 44ms	Script text/javascript	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQ3MTKR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 13 Aug 2024 15:15:05 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 660 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Tue, 13 Aug 2024 17:15:05 GMT
GET H2	200	destination Show response www.googletagmanager.com/gtag/	229 KB 83 KB	49ms 49ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-11158433171&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQ3MTKR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash dd078d7c41738785c85940a5935e159f6ec952a7750bb02179460e96699a6f61 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 84385 x-xss-protection 0 last-modified Tue, 13 Aug 2024 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 13 Aug 2024 15:26:05 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	118ms 36ms	Script application/javascript	2a02:26f0:780::210:ca3b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQ3MTKR Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:ca3b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jul 2024 05:33:09 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=49747 accept-ranges bytes content-length 14597
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	225 KB 60 KB	125ms 43ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 4d424af8e6254a3ee915b6efdec3f0ed3fcbdedc67c83025148c9758701cd2d4 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 13 Aug 2024 15:26:05 GMT document-policy force-load-at-top content-security-policy-report-only default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'report-sample';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; x-fb-server-load 44 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 58865 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=37, rtx=0, c=12, mss=1297, tbw=2788, tp=-1, tpl=-1, uplat=0, ullat=-1 pragma public x-fb-debug ZIaqi2eUp254BRPZAKHJt9MZGI4n6MaxYgWwutGNZBL6WdaP8/DcMO9OE8K8LJmR0oLF3ukt8rM3CfqPisXzRw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	ping.js Show response cdn.leadinfo.net/	130 KB 41 KB	163ms 47ms	Script application/javascript	54.230.228.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.leadinfo.net/ping.js Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.230.228.21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-54-230-228-21.muc50.r.cloudfront.net Software AmazonS3 / Resource Hash f5b72aab0129f969f042eb43a2904f3d6ff05d7b1c0e4bd68212e61a2226a9cf Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Thu, 23 May 2024 14:55:41 GMT x-amz-version-id HMLq1alrOnIjRAjv83WZly2vHsxpRhw. content-encoding br via 1.1 65bfa9839a30709dc259dc9134cf67b2.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P5 age 7086626 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Thu, 23 May 2024 14:55:38 GMT server AmazonS3 etag W/"39914cdc38551a4c870b1e7915b2e22a" vary Accept-Encoding, Origin content-type application/javascript cache-control private, max-age=900 x-amz-cf-id jhXIo2C8nrrXTfMlQCZQ6YAFYydiEpIRK5R7TbwXBoq0861r3wsusA==
GET H2	200	cf-location Show response js.hs-banner.com/v2/	5 B 148 B	89ms 36ms	Fetch text/plain	2606:4700::6812:17b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/cf-location Requested by Host: js.hs-banner.com URL: https://js.hs-banner.com/v2/45734016/banner.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2f52a803e38b1a3053feae52ec79f9bfd7b8a2a152b78bbd03741a6f461ad114 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:05 GMT server cloudflare vary Accept-Encoding content-type text/plain;charset=UTF-8 access-control-allow-origin * cache-control private, max-age=1500 cf-ray 8b29b8b718150d9c-MXP content-length 5
GET H3	200	v2.js Show response js.hsforms.net/forms/embed/ Frame 53B9	483 KB 0	79ms 42ms	Script application/javascript	104.18.142.119 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsforms.net/forms/embed/v2.js Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/embed/v2.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.142.119 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dfdf1af1a230e3ee08968606c4322f5a9c51a5a6bf341687fedac60716c9ddab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-encoding gzip age 55 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5781/bundles/project-v2.js&cfRay=8af9b11cdedc83ac-MXP x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"07033d485ccfcdda144e7a4173dbc0bc" vary accept-encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.5781/bundles/project-v2.js date Tue, 13 Aug 2024 15:26:05 GMT via 1.1 9d2dee9b44718f249b789987d2cbe62c.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-version-id __TkXxzKt.v8sm6CVT1EUR2QdTtEmM_4 cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 5ed8fb6b-ecb4-4b85-946d-2a592ea1bf93 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 5ed8fb6b-ecb4-4b85-946d-2a592ea1bf93 last-modified Wed, 07 Aug 2024 13:25:19 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AXbzwhGFba9Q320PW06uCoJ7Ljfks6PYvsNCV%2Bd8MKv2U4%2Bm%2BFuw9FOaXx65rWQMQEPb8wuSbtEjzfJibRRDF6MSWjPNxgPMB6CyEHh8lbuYVYa2Gw4JVVAl3yroY1BR"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-5f4dcb8bc8-vjwjs cf-ray 8b29b8b30c655234-MXP x-amz-cf-id vgAbudLFFwkhDoFKvfvTnH8o9QAoySu2meWuExcUqHQGW2d1n5h_Sg==
POST H2	204	collect region1.analytics.google.com/g/	0 0	113ms 44ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-8N4N77BDJY&gtm=45je4880v9115476932z89115468038za200zb9115468038&_p=1723562765367&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=1590097125.1723562766&ul=it-it&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1723562765&sct=1&seg=0&dl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&dt=AzzaSec%20Ransomware%20Technical%20Malware%20Analysis%20Report%20%7C%20ThreatMon&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1722 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-8N4N77BDJY&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 13 Aug 2024 15:26:05 GMT server Golfe2 content-type text/plain access-control-allow-origin https://threatmon.io cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 251 B	133ms 44ms	Ping text/plain	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8N4N77BDJY&cid=1590097125.1723562766&gtm=45je4880v9115476932z89115468038za200zb9115468038&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&tag_exp=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-8N4N77BDJY&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 13 Aug 2024 15:26:06 GMT server Golfe2 content-type text/plain access-control-allow-origin https://threatmon.io cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	171ms 70ms	Image image/gif	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8N4N77BDJY&cid=1590097125.1723562766&gtm=45je4880v9115476932z89115468038za200zb9115468038&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&tag_exp=0&tag_exp=0&z=1560432815 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 13 Aug 2024 15:26:06 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	counters.gif forms-na1.hsforms.com/embed/v3/	35 B 850 B	236ms 192ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id ef5d9fe5-3a8f-4dd5-b0bf-c9aafd901761 x-envoy-upstream-service-time 37 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id ef5d9fe5-3a8f-4dd5-b0bf-c9aafd901761 server cloudflare vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-xz9v8 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 8b29b8b79bc10dc6-MXP
GET H2	200	css2 fonts.googleapis.com/ Frame 53B9	6 KB 704 B	47ms 46ms	Stylesheet text/css	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Oswald:wght@400;500;700&display=swap Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/embed/v2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4bb96130fbb4727a3c0ac810e360024484915354d4746e31653bba7589d4d1c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 13 Aug 2024 15:26:05 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 13 Aug 2024 15:26:05 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 13 Aug 2024 15:26:05 GMT
GET H3	200	counters.gif forms-na1.hsforms.com/embed/v3/	35 B 885 B	219ms 177ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 12b21990-d6bd-41c5-a567-447b026ee119 x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 12b21990-d6bd-41c5-a567-447b026ee119 server cloudflare vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-2rthx access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 8b29b8b79bc00dc6-MXP
GET H2	200	combinedConfigs Show response cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/	2 KB 2 KB	182ms 175ms	Fetch application/json	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?contentIds=169543631444&portalId=45734016&currentUrl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 743609b5f917ec4f0579129891bd33c464fb1fb7372322f5cf4cb5f1355b379f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 88d6dd90-fd4a-4721-a86a-0a8ac8ab077b x-envoy-upstream-service-time 26 content-length 682 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 88d6dd90-fd4a-4721-a86a-0a8ac8ab077b server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://threatmon.io x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TQuiWeOp4bbHn8cc9gpvdr2dhWaoqRV2ZvxrVATNJA%2FCvXmYgvcvypt0yQ4MqSavVclTWcCMlsMAU7E95PY52nAxRgJ9m81x7TYyzC9cFMRtbEyuuvDyu0YRIbxWa5S1PQ9lkPTbQ%2FRradmOSCjd34MWVCbKXnt4gHA%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 8b29b8b76c8c0f72-MXP x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-vls5k
GET H3	200	hs-web-interactive-45734016-169543631444 45734016.hs-sites.com/ Frame F204	0 0	811ms 763ms	Document text/html	104.18.224.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://45734016.hs-sites.com/hs-web-interactive-45734016-169543631444 Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.224.114 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy upgrade-insecure-requests X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false alt-svc h3=":443"; ma=86400 cache-control s-maxage=10,max-age=5 cache-tag CT-169543631444,P-45734016,PGS-ALL,SW-1 cf-cache-status EXPIRED cf-ray 8b29b8b7bfc84c3c-MXP content-encoding br content-security-policy upgrade-insecure-requests content-type text/html;charset=utf-8 date Tue, 13 Aug 2024 15:26:06 GMT edge-cache-tag CT-169543631444,P-45734016,PGS-ALL,SW-1 last-modified Tue, 13 Aug 2024 15:26:06 GMT server cloudflare vary origin, Accept-Encoding x-content-type-options nosniff x-envoy-upstream-service-time 139 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/cms-hs-sites-td/envoy-proxy-fffdb9b56-2ktzt x-evy-trace-virtual-host all x-hs-cache-config BrowserCache-5s-EdgeCache-10s x-hs-content-id 169543631444 x-hs-hub-id 45734016 x-hubspot-correlation-id d698f3de-be73-4fb6-932b-9785f8810eee x-request-id d698f3de-be73-4fb6-932b-9785f8810eee x-robots-tag none
GET H3	200	hs-web-interactive-45734016-169543631444 45734016.hs-sites.com/ Frame 8A7B	0 0	812ms 812ms	Document text/html	104.18.224.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://45734016.hs-sites.com/hs-web-interactive-45734016-169543631444 Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.224.114 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy upgrade-insecure-requests X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false alt-svc h3=":443"; ma=86400 cache-control s-maxage=10,max-age=5 cache-tag CT-169543631444,P-45734016,PGS-ALL,SW-1 cf-cache-status EXPIRED cf-ray 8b29b8b7bfc84c3c-MXP content-encoding br content-security-policy upgrade-insecure-requests content-type text/html;charset=utf-8 date Tue, 13 Aug 2024 15:26:06 GMT edge-cache-tag CT-169543631444,P-45734016,PGS-ALL,SW-1 last-modified Tue, 13 Aug 2024 15:26:06 GMT server cloudflare vary origin, Accept-Encoding x-content-type-options nosniff x-envoy-upstream-service-time 139 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/cms-hs-sites-td/envoy-proxy-fffdb9b56-2ktzt x-evy-trace-virtual-host all x-hs-cache-config BrowserCache-5s-EdgeCache-10s x-hs-content-id 169543631444 x-hs-hub-id 45734016 x-hubspot-correlation-id d698f3de-be73-4fb6-932b-9785f8810eee x-request-id d698f3de-be73-4fb6-932b-9785f8810eee x-robots-tag none
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 1 KB	393ms 306ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers Accept * Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers attribution-reporting-register-trigger {"event_trigger_data":[{"priority":"0","trigger_data":"4"}],"filters":[{"c":["323622046"]},{"c":["318161013"]},{"c":["318124083"]},{"c":["279332313"]},{"c":["279326943"]}],"debug_key":"14521204"} content-encoding gzip date Tue, 13 Aug 2024 15:26:06 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: E2C014B9862D46A28341AA3C474D00B1 Ref B: ZRHEDGE1706 Ref C: 2024-08-13T15:26:06Z access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 x-li-proto http/2 x-restli-protocol-version 1.0.0 access-control-allow-headers * x-li-uuid AAYfkjpsv8i+2oi8Or77dQ== x-fs-uuid 00061f923a6cbfc8beda88bc3abefb75
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&e_ipv6=AQI30hUdEb2qRwAAAZFMWK...	0 265 B	229ms 165ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&e_ipv6=AQI30hUdEb2qRwAAAZFMWK9Wee627WvtgZ5gwTqNisdGmyFecAE9gK6aQvGoRumx4sI6gA Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 6A23512A1D7440D68D5A313A826BCBC3 Ref B: MRS20EDGE0117 Ref C: 2024-08-13T15:26:06Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYfkjpwovJMErnPjOcteA== Redirect headers date Tue, 13 Aug 2024 15:26:05 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: BB6CB47DC5D4440CA13216285EDB5F36 Ref B: MIL30EDGE1217 Ref C: 2024-08-13T15:26:06Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5430353&time=1723562765989&url=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&e_ipv6=AQI30hUdEb2qRwAAAZFMWK9Wee627WvtgZ5gwTqNisdGmyFecAE9gK6aQvGoRumx4sI6gA x-li-proto http/2 content-length 0 x-li-uuid AAYfkjpszUlplG+kkTLblg==
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 205 B	51ms 51ms	XHR text/plain	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1340839565&t=pageview&_s=1&dl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&ul=it-it&de=UTF-8&dt=AzzaSec%20Ransomware%20Technical%20Malware%20Analysis%20Report%20%7C%20ThreatMon&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1729589497&gjid=1341551053&cid=1590097125.1723562766&tid=UA-265880877-1&_gid=1509181569.1723562766&_r=1&_slc=1&gtm=45He4880n81KQ3MTKRv9115468038za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&z=1670356544 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 13 Aug 2024 15:26:06 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://threatmon.io cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 fonts.gstatic.com/s/oswald/v53/ Frame 53B9	21 KB 21 KB	35ms 35ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Oswald:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 99027d866818f716d208569108a962ac72200197cae503efe5b6bf002bf4915b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 14:10:10 GMT x-content-type-options nosniff age 4556 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 21444 x-xss-protection 0 last-modified Tue, 15 Aug 2023 18:38:40 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Aug 2025 14:10:10 GMT
GET H2	200	TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 fonts.gstatic.com/s/oswald/v53/ Frame 53B9	21 KB 0	36ms 36ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Oswald:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 99027d866818f716d208569108a962ac72200197cae503efe5b6bf002bf4915b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 14:10:10 GMT x-content-type-options nosniff age 4556 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 21444 x-xss-protection 0 last-modified Tue, 15 Aug 2023 18:38:40 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Aug 2025 14:10:10 GMT
GET H2	200	TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 fonts.gstatic.com/s/oswald/v53/ Frame 53B9	21 KB 0	37ms 37ms	Font font/woff2	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/oswald/v53/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Oswald:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 99027d866818f716d208569108a962ac72200197cae503efe5b6bf002bf4915b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 14:10:10 GMT x-content-type-options nosniff age 4556 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 21444 x-xss-protection 0 last-modified Tue, 15 Aug 2023 18:38:40 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Aug 2025 14:10:10 GMT
OPTIONS H2	200	view js.hs-banner.com/v2/activity/ Frame	0 0	149ms 149ms	Preflight application/octet-stream	2606:4700::6812:17b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/activity/view Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://threatmon.io Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://threatmon.io access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing access-control-max-age 604800 cf-cache-status DYNAMIC cf-ray 8b29b8b7b8fd0d9c-MXP content-length 0 content-type application/octet-stream date Tue, 13 Aug 2024 15:26:06 GMT server cloudflare timing-allow-origin * vary origin x-envoy-upstream-service-time 0 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-g9d49 x-evy-trace-virtual-host all x-hubspot-correlation-id b9f43ff0-3f7e-40d3-9e9c-8004f572531c x-request-id b9f43ff0-3f7e-40d3-9e9c-8004f572531c
GET H3	200	css2 fonts.googleapis.com/	2 KB 456 B	42ms 41ms	Stylesheet text/css	142.250.184.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap Requested by Host: js.hs-banner.com URL: https://js.hs-banner.com/v2/45734016/banner.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.202 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f10.1e100.net Software ESF / Resource Hash fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 13 Aug 2024 15:26:06 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 13 Aug 2024 13:50:54 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 13 Aug 2024 15:26:06 GMT
POST H2	204	view js.hs-banner.com/v2/activity/	0 0	157ms 155ms	Fetch	2606:4700::6812:17b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/activity/view Requested by Host: js.hs-banner.com URL: https://js.hs-banner.com/v2/45734016/banner.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type application/json Response headers date Tue, 13 Aug 2024 15:26:06 GMT x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator, envoyset-translator x-hubspot-correlation-id 4e0307e1-3161-4295-8432-34f91de789ee x-envoy-upstream-service-time 25 x-evy-trace-route-configuration listener_http/all, listener_https/all x-evy-trace-listener listener_http, listener_https x-request-id 4e0307e1-3161-4295-8432-34f91de789ee server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-evy-trace-virtual-host all, all x-evy-trace-served-by-pod iad02/private-hubapi-td/envoy-proxy-7f45f7f95b-9l65v, iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-wxrdh access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing access-control-allow-origin https://threatmon.io access-control-allow-credentials true access-control-max-age 604800 timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 8b29b8b8aaa60d9c-MXP
GET H2	200	download.svg threatmon.b-cdn.net/assets/images/	2 KB 1 KB	45ms 44ms	Image image/svg+xml	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Show image Full URL https://threatmon.b-cdn.net/assets/images/download.svg Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash 6013fb15d3c1f9df9a79506475ecc57cb85c3342ec9228a8a97ccfbf584bf573 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1079 cdn-cachedat 03/28/2024 09:19:38 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Mon, 29 May 2023 00:01:58 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"6473eb76-798" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 2070a4b71453547095f2bd3b4b1167a7 cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True
GET H2	200	json Show response forms.hscollectedforms.net/collected-forms/v1/config/	135 B 450 B	158ms 150ms	XHR application/json	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=45734016&utk= Requested by Host: js.hscollectedforms.net URL: https://js.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b1a87f4ecd665d2ce1ad2b2ba281b12ea6c3456be0ab667c4b8b556a97bd499 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 0ea4c296-6c02-4f79-a639-01c79959adb5 x-envoy-upstream-service-time 7 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0ea4c296-6c02-4f79-a639-01c79959adb5 server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://threatmon.io x-evy-trace-virtual-host all cache-control max-age=0 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-5f4dcb8bc8-c2t4f access-control-max-age 180 x-robots-tag none access-control-allow-headers * cf-ray 8b29b8b7eebc5242-MXP
GET H3	200	S6u9w4BMUTPHh6UVSwiPGQ.woff2 fonts.gstatic.com/s/lato/v24/	23 KB 23 KB	47ms 47ms	Font font/woff2	142.250.186.67 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.67 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f3.1e100.net Software sffe / Resource Hash c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 13:55:57 GMT x-content-type-options nosniff age 5409 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23040 x-xss-protection 0 last-modified Tue, 02 May 2023 15:07:25 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Aug 2025 13:55:57 GMT
GET H3	200	S6uyw4BMUTPHjx4wXg.woff2 fonts.gstatic.com/s/lato/v24/	23 KB 23 KB	33ms 33ms	Font font/woff2	142.250.186.67 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.67 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f3.1e100.net Software sffe / Resource Hash 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://threatmon.io User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 14:12:11 GMT x-content-type-options nosniff age 4435 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23580 x-xss-protection 0 last-modified Tue, 02 May 2023 15:17:22 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Aug 2025 14:12:11 GMT
GET H2	200	/ Show response collector.leadinfo.net/config/LI-647DC1558BE4E/	2 B 130 B	478ms 359ms	XHR application/json	52.17.217.229 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://collector.leadinfo.net/config/LI-647DC1558BE4E/ Requested by Host: cdn.leadinfo.net URL: https://cdn.leadinfo.net/ping.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.17.217.229 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-217-229.eu-west-1.compute.amazonaws.com Software / Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-origin https://threatmon.io date Tue, 13 Aug 2024 15:26:06 GMT content-length 2 vary Origin content-type application/json; charset=utf-8
GET H2	200	LI-647DC1558BE4E Show response api.leadinfo.com/v1/identify/	2 B 328 B	290ms 166ms	XHR application/json	34.255.226.66 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.leadinfo.com/v1/identify/LI-647DC1558BE4E Requested by Host: cdn.leadinfo.net URL: https://cdn.leadinfo.net/ping.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.255.226.66 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-255-226-66.eu-west-1.compute.amazonaws.com Software Apache/2.4.61 (Debian) / Leadinfo Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 13 Aug 2024 15:26:06 GMT strict-transport-security max-age=63072000; includeSubDomains; preload server Apache/2.4.61 (Debian) x-powered-by Leadinfo access-control-allow-methods GET content-type application/json; charset=UTF-8 access-control-allow-origin https://threatmon.io cache-control no-cache, no-store, must-revalidate access-control-allow-headers Origin content-length 2 expires 0
GET H2	200	1274518423482813 Show response connect.facebook.net/signals/config/	61 KB 13 KB	120ms 120ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1274518423482813?v=2.9.164&r=stable&domain=threatmon.io&hme=61ff4e692c87a9a2ce7b19822df2b04638e3ca38b23c1be6c0f1945ccadb2ad5&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C167%2C170%2C182%2C178%2C179%2C181%2C29%2C98%2C52%2C75%2C180%2C162%2C165%2C175%2C176%2C183%2C127%2C40%2C34%2C139%2C15%2C49%2C189%2C188%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C163%2C166%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 950a277b1ca26e8a5c0e7f32e06fd4d1009ded22dabff8c350314987488dd03a Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 13 Aug 2024 15:26:06 GMT document-policy force-load-at-top x-fb-server-load 35 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=44, rtx=0, c=66, mss=1297, tbw=64893, tp=-1, tpl=-1, uplat=80, ullat=0 pragma public x-fb-debug FHhn0wsj1z6n30FKcZGFw7FyZ8CQuHet3gJu45A9vDmfDgGN2RAoeSQkqjlsnhpui0zcoNhox8+D2TBpUGQGiw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 892 B	237ms 225ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 91877f18-0678-4bdd-9d44-e0e8e06c470e x-envoy-upstream-service-time 3 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 91877f18-0678-4bdd-9d44-e0e8e06c470e last-modified Tue, 13 Aug 2024 15:26:06 GMT server cloudflare vary origin, Accept-Encoding content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-xwp6c access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false accept-ranges bytes x-robots-tag none cf-ray 8b29b8b89d430dc6-MXP
GET H2	200	blank001.gif static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/ Redirect Chain https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=335575774567&containerType=EMBEDDED&portalId=45734016&audienceId=null&pageUrl=https%3A%2F%2Fthreatmon.io%... https://static.hubspot.com/img/trackers/blank001.gif https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif	43 B 963 B	103ms 41ms	Image image/gif	2606:4700::6811:b05b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Server 2606:4700::6811:b05b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT via 1.1 69b8255864bcbab6fa21e4a2a96c169e.cloudfront.net (CloudFront) x-amz-version-id MFfZlkR4U8_6aknbgflTSIqo4fNbniK3 cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop MXP63-P2 age 1873564 cf-polished origSize=49, status=webp_bigger x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront x-amz-replication-status COMPLETED content-length 43 cf-bgj imgq:85,h2pri last-modified Thu, 15 Apr 2021 16:47:19 GMT server cloudflare etag "51416c7ff0b9d7efc8c9b16d84052fab" vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wcu1r343RM0IQmqJN7Z8KpLBZBPHQCsIXijmuoFnM1RA8hmEiei3rSNMkf0EDusxQwRcg7Oyjo26IUn6oH%2Fkv6vw%2BvdILkfEnlWv0pqK43G%2FLum5DqMraEdHfuwOfVuBuYdzIr7fApyeDqxCXaU%2FxS17DN0%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control public, max-age=31536000 accept-ranges bytes cf-ray 8b29b8ba2dfd0e9f-MXP x-amz-cf-id -lJSJkSRpqIiDzEPOT1-i05-YeVTZN6cH0xjZ-Xe-xtRT0VRDrqvhg== expires Wed, 13 Aug 2025 15:26:06 GMT Redirect headers date Tue, 13 Aug 2024 15:26:06 GMT strict-transport-security max-age=31536000; includeSubDomains; preload nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=84wKk3c2FjPeCeuRHT%2Ff3WVs2xukgVtZaIKMet9jPzy1%2FP2cowAV%2BS6kOZJETLppwtzVJ%2B3NNx8mJcoOYN2Ggbes0rbPBwdSIVZjv7o1z0EWQmg%2BhgrTtXb0Iz1Y4raHlVyEn4HrhW69uHavx826dQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html location https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif cache-control max-age=3600 cf-ray 8b29b8b988850dfa-MXP content-length 167 expires Tue, 13 Aug 2024 16:26:06 GMT
GET H3	200	hs-web-interactive-45734016-174928057266 45734016.hs-sites.com/ Frame B0A4	0 0	664ms 664ms	Document text/html	104.18.224.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://45734016.hs-sites.com/hs-web-interactive-45734016-174928057266?enableResponsiveStyles=true Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.224.114 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy upgrade-insecure-requests X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false alt-svc h3=":443"; ma=86400 cache-control s-maxage=10,max-age=5 cache-tag CT-174928057266,P-45734016,PGS-ALL,SW-1 cf-cache-status EXPIRED cf-ray 8b29b8b889034c3c-MXP content-encoding br content-security-policy upgrade-insecure-requests content-type text/html;charset=utf-8 date Tue, 13 Aug 2024 15:26:06 GMT edge-cache-tag CT-174928057266,P-45734016,PGS-ALL,SW-1 last-modified Tue, 13 Aug 2024 15:26:06 GMT server cloudflare vary origin, Accept-Encoding x-content-type-options nosniff x-envoy-upstream-service-time 159 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/cms-hs-sites-td/envoy-proxy-fffdb9b56-r7xsm x-evy-trace-virtual-host all x-hs-cache-config BrowserCache-5s-EdgeCache-10s x-hs-content-campaign-id a9e7c9f7-9283-4319-8446-b3158f95a8d0 x-hs-content-id 174928057266 x-hs-hub-id 45734016 x-hubspot-correlation-id 75a8da93-3d4b-449d-9140-20b4a2838aab x-request-id 75a8da93-3d4b-449d-9140-20b4a2838aab x-robots-tag none
GET H/1.1	200 OK	json Show response pro.ip-api.com/	215 B 371 B	117ms 35ms	Fetch application/json	51.77.64.70 OVH
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/json?key=zPwv6i0dpmS2yR5&fields=proxy,hosting,isp,lat,long,zip,city,region,status,country,timezone,regionName,countryCode Requested by Host: s3-us-west-2.amazonaws.com URL: https://s3-us-west-2.amazonaws.com/b2bjsstore/b/YE63P0HM2VOW/reb2b.js.gz Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.77.64.70 , Germany, ASN16276 (OVH, FR), Reverse DNS de-fra-1.pro.ip-api.com Software / Resource Hash 6c39380ad5b63a53f7f1cd08d2965a52e4b4259447cf0b317805e6f7bdfd712a Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Tue, 13 Aug 2024 15:26:06 GMT Content-Length 215 Content-Type application/json; charset=utf-8
GET H2	200	/ www.facebook.com/tr/	0 274 B	115ms 39ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1274518423482813&ev=PageView&dl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&rl=&if=false&ts=1723562766259&sw=1600&sh=1200&v=2.9.164&r=stable&ec=0&o=4126&fbp=fb.1.1723562766258.240939560437054040&ler=empty&cdl=API_unavailable&it=1723562766125&coo=false&rqm=GET Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=36, rtx=0, c=10, mss=1297, tbw=2838, tp=-1, tpl=-1, uplat=0, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Tue, 13 Aug 2024 15:26:06 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 3 KB	251ms 174ms	Image image/png	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1274518423482813&ev=PageView&dl=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&rl=&if=false&ts=1723562766259&sw=1600&sh=1200&v=2.9.164&r=stable&ec=0&o=4126&fbp=fb.1.1723562766258.240939560437054040&ler=empty&cdl=API_unavailable&it=1723562766125&coo=false&rqm=FGET Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding zstd x-content-type-options nosniff strict-transport-security max-age=15552000; preload nel {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01} date Tue, 13 Aug 2024 15:26:06 GMT document-policy force-load-at-top x-fb-server-load 31 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7402645712766048030", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=36, rtx=0, c=15, mss=1297, tbw=3156, tp=-1, tpl=-1, uplat=135, ullat=0 pragma no-cache x-fb-debug GfpXPhJ9OcCEo0A0D4ozRkRVCqIQANeAOrqfPDVi+HG7f450OlYt4nAhQOIlvz62qZAmqvvRuMZrBrMyFjWWzw== cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7402645712766048030"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7402645712766048030"}],"group":"network-errors"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type image/png x-frame-options DENY origin-agent-cluster ?0 cache-control private, no-store, no-cache, must-revalidate permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 194 B	209ms 208ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept * Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 13 Aug 2024 15:26:06 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 1721E0589E1A4CDEADE3A6C3CD416353 Ref B: MIL30EDGE1217 Ref C: 2024-08-13T15:26:06Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://threatmon.io x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYfkjpzPB0bjwwcNR8PKw==
OPTIONS H2	200	tp2 collector.leadinfo.net/com.snowplowanalytics.snowplow/ Frame	0 0	56ms 56ms	Preflight	52.17.217.229 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://collector.leadinfo.net/com.snowplowanalytics.snowplow/tp2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.17.217.229 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-217-229.eu-west-1.compute.amazonaws.com Software spray-can/1.3.3 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://threatmon.io Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type access-control-allow-origin https://threatmon.io content-length 0 date Tue, 13 Aug 2024 15:26:06 GMT server spray-can/1.3.3
POST H2	200	tp2 Show response collector.leadinfo.net/com.snowplowanalytics.snowplow/	2 B 227 B	180ms 60ms	XHR text/plain	52.17.217.229 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://collector.leadinfo.net/com.snowplowanalytics.snowplow/tp2 Requested by Host: cdn.leadinfo.net URL: https://cdn.leadinfo.net/ping.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.17.217.229 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-217-229.eu-west-1.compute.amazonaws.com Software spray-can/1.3.3 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers p3p policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" access-control-allow-origin https://threatmon.io date Tue, 13 Aug 2024 15:26:06 GMT access-control-allow-credentials true server spray-can/1.3.3 content-length 2 content-type text/plain; charset=UTF-8
POST H2	200	tp2 Show response collector.leadinfo.net/com.snowplowanalytics.snowplow/	2 B 226 B	61ms 60ms	XHR text/plain	52.17.217.229 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://collector.leadinfo.net/com.snowplowanalytics.snowplow/tp2 Requested by Host: cdn.leadinfo.net URL: https://cdn.leadinfo.net/ping.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.17.217.229 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-217-229.eu-west-1.compute.amazonaws.com Software spray-can/1.3.3 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers p3p policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" access-control-allow-origin https://threatmon.io date Tue, 13 Aug 2024 15:26:06 GMT access-control-allow-credentials true server spray-can/1.3.3 content-length 2 content-type text/plain; charset=UTF-8
GET H3	200	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 581 B	160ms 160ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=interactive-shown&value=1 Requested by Host: threatmon.io URL: https://threatmon.io/azzasec-ransomware-technical-malware-analysis-report/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:07 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d9298876-6c1c-48dc-a429-aa0a9890dc15 x-envoy-upstream-service-time 10 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d9298876-6c1c-48dc-a429-aa0a9890dc15 last-modified Tue, 13 Aug 2024 15:26:07 GMT server cloudflare vary origin, Accept-Encoding content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-xz9v8 access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false accept-ranges bytes x-robots-tag none cf-ray 8b29b8bdbdab0dc6-MXP
GET H2	200	__ptq.gif track.hubspot.com/	45 B 932 B	152ms 152ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=872352201&v=1.1&a=45734016&rcu=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&pu=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&t=AzzaSec+Ransomware+Technical+Malware+Analysis+Report+%7C+ThreatMon&cts=1723562767910&rv=1&vi=1816cf8546d4410363dc1c65140f18e7&nc=true&ce=false&cc=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:08 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 152a1148-5505-4c87-8783-4504765d26c4 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 6 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 152a1148-5505-4c87-8783-4504765d26c4 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ZlkEtvRzMe%2BZTwIN06ScYcFo0NuHHxN5xhYKz8VzYBiuANGY9kI31pwVEPkaKv76D7C9%2BtFiY%2FsoXdTMhOAGgtxUpIzGcb5fr%2F8gkAaeCXuW8IeI7C6sLTrkewEA3TyCKN577g04qcGftC0%2BX9E"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-rtlfs x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8b29b8c378b20dfa-MXP x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 745 B	163ms 163ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=15&fi=976b5fae-fe8f-49b3-b6c0-dcafa13131dd&fci=f1854eb7-1b13-46f6-9c23-68cee50c1c45&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=872352201&v=1.1&a=45734016&rcu=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&pu=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&t=AzzaSec+Ransomware+Technical+Malware+Analysis+Report+%7C+ThreatMon&cts=1723562767911&rv=1&vi=1816cf8546d4410363dc1c65140f18e7&nc=true&ce=false&cc=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:08 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 5952b1f3-be74-4bfa-8191-fde156359e06 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 8 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 5952b1f3-be74-4bfa-8191-fde156359e06 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oGAGCmgxUtBwGn4JhQsOMQAyxNn4yYoR3QYKVXjRsQ6Hy0dh29F%2BNceH92oRIpfHbauXuIVd0GFZuuZ4RKaeSu9L48DNjT2OVHHR%2Fh8eVtL06QAZpzY5DuKSvyooCsiBNvIwcvNy%2Blh16tpzNXIn"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-wj7dn x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8b29b8c388bc0dfa-MXP x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 939 B	162ms 162ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=17&fi=976b5fae-fe8f-49b3-b6c0-dcafa13131dd&fci=f1854eb7-1b13-46f6-9c23-68cee50c1c45&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=872352201&v=1.1&a=45734016&rcu=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&pu=https%3A%2F%2Fthreatmon.io%2Fazzasec-ransomware-technical-malware-analysis-report%2F&t=AzzaSec+Ransomware+Technical+Malware+Analysis+Report+%7C+ThreatMon&cts=1723562767911&rv=1&vi=1816cf8546d4410363dc1c65140f18e7&nc=true&ce=false&cc=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:08 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 761f5a6b-d0be-4153-981c-59bfc7c1fb81 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 13 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 761f5a6b-d0be-4153-981c-59bfc7c1fb81 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vNa%2F2BgIyuqkfPmm5N2IpgMJCkXvC00zcV4rT%2BdLhNwC5a0V2LW9XSb3M4Zykmh1x7R2bn%2FEUgaZHLQooZEifXPpK1Uet4LuR9%2FNpwVq6iCSR33jOl5EhCcYp0FRRkkHjKpERQUEW%2FW%2FIxtAqb%2BI"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-pbqz5 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8b29b8c388be0dfa-MXP x-robots-tag none
GET H3	200	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 580 B	157ms 157ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=interactive-shown&value=1 Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:08 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id cb477efa-953b-4035-9c9e-a0041b4f976f x-envoy-upstream-service-time 3 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id cb477efa-953b-4035-9c9e-a0041b4f976f last-modified Tue, 13 Aug 2024 15:26:08 GMT server cloudflare vary origin, Accept-Encoding content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-gfhhz access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false accept-ranges bytes x-robots-tag none cf-ray 8b29b8c38fcd0dc6-MXP
GET H2	200	blank001.gif static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/ Redirect Chain https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/view?webInteractiveId=352884807570&containerType=BANNER&portalId=45734016&audienceId=null&campaignId=a9e7c9f7-9283-4319-8446-b3... https://static.hubspot.com/img/trackers/blank001.gif https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif	43 B 0	0ms 0ms	Image image/gif	2606:4700::6811:b05b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif Protocol H2 Server 2606:4700::6811:b05b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 115c7f3cf61e4ec19070b9e59e20e78756d39d193eb9b544065059b9935d2491 Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:06 GMT via 1.1 69b8255864bcbab6fa21e4a2a96c169e.cloudfront.net (CloudFront) x-amz-version-id MFfZlkR4U8_6aknbgflTSIqo4fNbniK3 cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP63-P2 age 1873564 cf-polished origSize=49, status=webp_bigger x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront x-amz-replication-status COMPLETED content-length 43 cf-bgj imgq:85,h2pri last-modified Thu, 15 Apr 2021 16:47:19 GMT server cloudflare etag "51416c7ff0b9d7efc8c9b16d84052fab" vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wcu1r343RM0IQmqJN7Z8KpLBZBPHQCsIXijmuoFnM1RA8hmEiei3rSNMkf0EDusxQwRcg7Oyjo26IUn6oH%2Fkv6vw%2BvdILkfEnlWv0pqK43G%2FLum5DqMraEdHfuwOfVuBuYdzIr7fApyeDqxCXaU%2FxS17DN0%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control public, max-age=31536000 accept-ranges bytes cf-ray 8b29b8ba2dfd0e9f-MXP x-amz-cf-id -lJSJkSRpqIiDzEPOT1-i05-YeVTZN6cH0xjZ-Xe-xtRT0VRDrqvhg== expires Wed, 13 Aug 2025 15:26:06 GMT Redirect headers date Tue, 13 Aug 2024 15:26:06 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=84wKk3c2FjPeCeuRHT%2Ff3WVs2xukgVtZaIKMet9jPzy1%2FP2cowAV%2BS6kOZJETLppwtzVJ%2B3NNx8mJcoOYN2Ggbes0rbPBwdSIVZjv7o1z0EWQmg%2BhgrTtXb0Iz1Y4raHlVyEn4HrhW69uHavx826dQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html location https://static.hsappstatic.net/static-hubspot-com/static-1.270519761/img/trackers/blank001.gif cache-control max-age=3600 cf-ray 8b29b8b988850dfa-MXP content-length 167 expires Tue, 13 Aug 2024 16:26:06 GMT
GET H2	200	favicon.ico threatmon.b-cdn.net/assets/images/favicon/	15 KB 3 KB	115ms 115ms	Other image/x-icon	2400:52e0:1e00::1082:1 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://threatmon.b-cdn.net/assets/images/favicon/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1082:1 , Germany, ASN60068 (CDN77 _, GB), Reverse DNS Software BunnyCDN-DE1-1082 / Resource Hash f42318211a2b038cd95ed902a6ea000f1c4759a6cab07e157772c38d2e44f1a6 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://threatmon.io/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 13 Aug 2024 15:26:08 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1079 cdn-cachedat 03/27/2024 00:01:58 cdn-pullzone 1606769 x-xss-protection 1; mode=block last-modified Thu, 18 May 2023 20:32:00 GMT server BunnyCDN-DE1-1082 cdn-proxyver 1.04 cdn-requestpullcode 200 etag W/"64668b40-3aee" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/x-icon cdn-cache HIT cdn-uid 94995b2a-3c4c-49f5-9a55-6ca83a24ae66 cache-control public, max-age=2592000 cdn-requestid 2b18d45a7a2f4a623d4167c83d4d74ff cdn-requestcountrycode IT cdn-status 200 cdn-requestpullsuccess True