URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Submission: On May 06 via api from CH

Summary

This website contacted 22 IPs in 5 countries across 16 domains to perform 137 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is securityaffairs.co.
TLS certificate: Issued by GeoTrust RSA CA 2018 on February 21st 2019. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 42 2001:8d8:100f... 8560 (ONEANDONE...)
1 209.197.3.15 20446 (HIGHWINDS3)
1 23.67.137.77 20940 (AKAMAI-ASN1)
2 2.19.43.118 20940 (AKAMAI-ASN1)
9 192.0.77.2 2635 (AUTOMATTIC)
20 23.210.250.97 16625 (AKAMAI-AS)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
3 2a03:2880:f01... 32934 (FACEBOOK)
1 192.0.77.32 2635 (AUTOMATTIC)
2 192.0.76.3 2635 (AUTOMATTIC)
1 2.16.186.146 20940 (AKAMAI-ASN1)
1 3 18.195.194.147 16509 (AMAZON-02)
9 2a00:1450:400... 15169 (GOOGLE)
14 23.62.140.165 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
12 172.217.23.130 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 54.193.49.97 16509 (AMAZON-02)
137 22
Domain Requested by
42 securityaffairs.co 1 redirects securityaffairs.co
20 contextual.media.net securityaffairs.co
contextual.media.net
12 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
securityaffairs.co
9 www.googletagservices.com securityaffairs.co
securepubads.g.doubleclick.net
7 hbx-lg.media.net
7 lg3.media.net securityaffairs.co
contextual.media.net
5 i1.wp.com securityaffairs.co
3 navvy.media.net contextual.media.net
3 tpc.googlesyndication.com securepubads.g.doubleclick.net
3 adservice.google.com www.googletagservices.com
3 adservice.google.de www.googletagservices.com
3 l.sharethis.com 1 redirects securityaffairs.co
3 i0.wp.com securityaffairs.co
2 connect.facebook.net securityaffairs.co
connect.facebook.net
1 www.google-analytics.com
1 google-analytics.com securityaffairs.co
1 pixel.wp.com securityaffairs.co
1 staticxx.facebook.com connect.facebook.net
1 c.sharethis.mgr.consensu.org ws.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 stats.wp.com securityaffairs.co
1 s0.wp.com securityaffairs.co
1 secure.gravatar.com securityaffairs.co
1 i2.wp.com securityaffairs.co
1 platform-api.sharethis.com securityaffairs.co
1 ws.sharethis.com securityaffairs.co
1 maxcdn.bootstrapcdn.com securityaffairs.co
0 fonts.googleapis.com Failed securityaffairs.co
137 28
Subject Issuer Validity Valid
www.securityaffairs.co
GeoTrust RSA CA 2018
2019-02-21 -
2020-03-22
a year crt.sh
*.bootstrapcdn.com
COMODO RSA Domain Validation Secure Server CA
2018-10-03 -
2019-10-12
a year crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA
2018-12-16 -
2020-03-16
a year crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2
2018-04-10 -
2020-05-11
2 years crt.sh
*.media.net
DigiCert SHA2 Secure Server CA
2018-12-30 -
2020-03-30
a year crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA
2018-09-06 -
2020-09-05
2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-03-08 -
2019-06-06
3 months crt.sh
*.sharethis.mgr.consensu.org
DigiCert ECC Secure Server CA
2018-07-31 -
2019-07-31
a year crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2019-04-16 -
2019-07-09
3 months crt.sh
*.google.com
Google Internet Authority G3
2019-04-16 -
2019-07-09
3 months crt.sh
tpc.googlesyndication.com
Google Internet Authority G3
2019-04-16 -
2019-07-09
3 months crt.sh
*.google-analytics.com
Google Internet Authority G3
2019-04-16 -
2019-07-09
3 months crt.sh

This page contains 19 frames:

Primary Page: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Frame ID: CF082B03E03DEBDF53545F5AF7A18BC2
Requests: 82 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 36E84C385936A510BEBF8E9CDC6B0C1D
Requests: 1 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter/r/d_vbiawPdxB.js?version=44
Frame ID: F1574D07662E659D557BC1E3D3518990
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109&rtime=6&https=1&gdpr=1&gdprconsent=2
Frame ID: 3AE8AE6BB0CE9D03519FDC7E40963477
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045302438562&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: 2480DAB37D05165709976A94DF236918
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 87E3D9E52D98F7152300B59773248623
Requests: 8 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045438324636&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: 28BA5B264D828B669DF27CEFF5AA7ADD
Requests: 3 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: D076647A12F5E9CB1EBE0115E8A87914
Requests: 8 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045319500751&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: B77904C7BA3262DB5156038930467D00
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: A6472136663626D3638DF816115EAFEC
Requests: 8 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8POV70GQX&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1557126045438324636&lw=1&ugd=4&ib=0&katid=801333254&katbid=-21&nb=1
Frame ID: 89CE90B2866DBBE930805D805A00411F
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8POV70GQX&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1557126045302438562&lw=1&ugd=4&ib=0&katid=800496418&katbid=-21&nb=1
Frame ID: 969769056DA8870FC9DA7C37EA07E9CD
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8POV70GQX&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=hmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1557126045319500751&lw=1&ugd=4&ib=0&katid=801333013&katbid=-21&nb=1
Frame ID: C68A5955E8732C8A1EED525157295188
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst0JYPeYfBSI8g85saLna6XJH8RfsXHU2MIV8jnlTIafizz8__ef2rYrKBDuKGtgdWNYXIAOCQFspk5gkhPmaWDEFn79sPrih6yXqoQRJSEfKqwbYybdAEAiBFUav1gMDj7BNEkx1czxYn4KjsN3mT-eVCvFNa3I6No-gGITR6VKCWRbRz6CZrfEGnm0Dh5l_tf4eRmEKlUImy5O7dO34hwEJXSXeA0nO4TjJjBQ_Jrzm_zCUbrSOUGxvMLTQTdbD-7hGxmYPAH23Q-qUw6UxeZaDeZINbecVh9cgg&sai=AMfl-YSnCeEOI6-qLFqS85UaFB35TTKFhjFidKqldpQNXzHazPyEIfjXJtRYtgj5U7NlDdqiYgp0Vg9QvQPxC1cdUO1Y4KPEpBJjdKkK8kMQ&sig=Cg0ArKJSzNCDYTKKaNlDEAE&urlfix=1&adurl=
Frame ID: AC4A347FA8C4F50EBA72A13FCF9F8485
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/__media__/js/util/nrrV814.js
Frame ID: 36FD27D5E01D7C05D83D81D1BD5EE6BE
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqUdKXSq5SFhe1mpqE9OW6Wn2dypRWSUk4rGNQmkP9tk2sZJGzuwL7Xci27pcoNpvtd1BoWElDEQqwpv0DNhJzB4QBwTnqP76fqo9poZsDRrzk0IlCtIdbiMRR6Zq8UhDCwJV_FI-lCY4dPBOgkKpKlnZbDApmYCv3yeGx3CE0WpA1wmm--E4UIRI21USDS-FI_670QAzJkzDYHHC--djByaQYeoLbzU4itsdJoHVgimQ3B8yu99_jPbWZH6TdQpZH_Dsv72GRE8FAaZlrOt5p3982PWCmV5b5sWgDPpLI&sai=AMfl-YSLgtSTDu4ZH9zXqriuYlEelRJlMPi7kfhSNfLQItN2oY2rDe5vr2aVVwnhmxNL8Lvj0rYaPBTMI4UZgQz9KG8aIrMVDWkzZkfCOxeWYg&sig=Cg0ArKJSzMl8E7bfTezMEAE&urlfix=1&adurl=
Frame ID: 5359BED599F3150FAC0F9B96B79F7C49
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/__media__/js/util/nrrV814.js
Frame ID: 2E4074E2C247EDE7262261D2A6A7D4E3
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6Qg-JDTZdDeaI4rRJVHcI0on6AEOca9bDX4vYjboBVXOPKvYaNZhwayeeHvQ-iR-VwFf_PyAr7AqvsopJOB_HDbWer2WGCtgeKj1d6Nc6oIh0xvulfSMRW5hQbrEZyLVjnt79LecY_MyZdSv9N2Y0-9EQF58rwqBA7wOfmiSKnlFqgkTr6NIzvVAPmpAWON4m9RQtMPN_iSUfAurrgvVtkd3itRmPloGR0jPd3SDbkG4GlfAm7PquSXkoKMrGq5uLeW6i4zSTsntpr523QOS2_DKEAVGzxZDKGBYGG-ItqZn8gzq0eVLK9LFf8w&sai=AMfl-YRuNoEGXnUxH10Ur-XoSnB_E_OpVb-3O_tqlp7096UvAPp4BgqtfNHkn7cQ_1Q84c5phHhmFciimeEaXbbM8qYkyu57yYL_P_iWGiOh&sig=Cg0ArKJSzDuE8C3GDzgSEAE&urlfix=1&adurl=
Frame ID: 14C8AD2A2E476349BB9BF8BD5AEA8E38
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/__media__/js/util/nrrV814.js
Frame ID: F58253F6743053E38FE859C691ABEB30
Requests: 5 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • env /^mejs$/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • env /^twemoji$/i

Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

137
Requests

97 %
HTTPS

43 %
IPv6

16
Domains

28
Subdomains

22
IPs

5
Countries

2136 kB
Transfer

3805 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64
  • https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16a8bf1dd0b-462970cb-1&sessionID=1557126044940.46545&hostname=securityaffairs.co&location=%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&product=simpleshare&fcmp=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sharURL=&buttonType=ERROR&destination=ERROR&source=ERROR&title=Victims%20of%20ZQ%20Ransomware%20can%20decrypt%20their%20files%20for%20freeSecurity%20Affairs&ts1557126044941.0=&sop=false HTTP 301
  • https://l.sharethis.com/sc?cm=ZGAP61zP250AAAASA34CAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sop=false
Request Chain 79
  • https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script HTTP 301
  • https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script

137 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request zq-ransomware-decryptor.html
securityaffairs.co/wordpress/84768/malware/
67 KB
18 KB
Document
General
Full URL
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.17
Resource Hash
cf98bbd1923f8432df3b6cc078ec3e999a702e7015486591ef4502a359b3ce4c

Request headers

:method
GET
:authority
securityaffairs.co
:scheme
https
:path
/wordpress/84768/malware/zq-ransomware-decryptor.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
content-type
text/html; charset=UTF-8
date
Mon, 06 May 2019 07:00:42 GMT
server
Apache
x-powered-by
PHP/7.2.17
vary
Accept-Encoding,Cookie
x-pingback
https://securityaffairs.co/wordpress/xmlrpc.php
link
<https://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <https://securityaffairs.co/wordpress/?p=84768>; rel=shortlink
content-encoding
gzip
style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/
30 KB
31 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f42551c6cb1f3a2597f99bdb1b458a5224c04d14de425efc4c1f543bbc1a2570

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:43 GMT
last-modified
Wed, 09 Jan 2019 21:49:08 GMT
server
Apache
etag
"79d7-57f0d6e7da124"
content-type
text/css
status
200
accept-ranges
bytes
content-length
31191
cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
3 KB
3 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=1.7.6
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
25828e937e993ca19df9dcecfcacf886ce7777a9918147097153f2710de2ccc6

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:43 GMT
last-modified
Fri, 15 Mar 2019 23:00:40 GMT
server
Apache
etag
"b55-5842a0200bcee"
content-type
text/css
status
200
accept-ranges
bytes
content-length
2901
cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
12 KB
12 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=1.7.6
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
bf59c6832eb9df82772307968b03faa3ed06bf8b2bd2bd994e5ac900e7ac58da

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:43 GMT
last-modified
Fri, 15 Mar 2019 23:00:40 GMT
server
Apache
etag
"2f4d-5842a0200bcee"
content-type
text/css
status
200
accept-ranges
bytes
content-length
12109
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/
23 KB
5 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x00f.map2.ssl.hwcdn.net
Software
/
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:43 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:35:19 GMT
access-control-allow-origin
*
etag
"1544639719"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
5442
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/
19 KB
20 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 13:54:59 GMT
server
Apache
etag
"4d92-52704407f72c0"
content-type
text/css
status
200
accept-ranges
bytes
content-length
19858
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
539 B
683 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
etag
"21b-526fe6d7cd700"
content-type
text/css
status
200
accept-ranges
bytes
content-length
539
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
6 KB
6 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 13:55:09 GMT
server
Apache
etag
"1851-5270441180940"
content-type
text/css
status
200
accept-ranges
bytes
content-length
6225
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/
11 KB
11 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.6-78496d1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Thu, 16 Nov 2017 13:57:00 GMT
server
Apache
etag
"2be0-55e19fe77c80f"
content-type
text/css
status
200
accept-ranges
bytes
content-length
11232
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
2 KB
2 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"6b4-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
1716
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
17 KB
18 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"4574-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
17780
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
5 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
etag
"118d-526fe6e527680"
content-type
text/css
status
200
accept-ranges
bytes
content-length
4493
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
334 B
478 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"14e-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
334
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
110 KB
110 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
etag
"1b844-526fe6d7cd700"
content-type
text/css
status
200
accept-ranges
bytes
content-length
112708
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/
12 KB
12 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.17
Resource Hash
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 06 May 2019 07:00:44 GMT
server
Apache
x-powered-by
PHP/7.2.17
content-type
text/css; charset: UTF-8;charset=UTF-8
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
49 KB
50 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:03 GMT
server
Apache
etag
"c5f2-526fe6d6d94c0"
content-type
text/css
status
200
accept-ranges
bytes
content-length
50674
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
95 KB
95 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
fa055f2f7c5b735dbbb71954f434aed79925bc00ff2ffbc3ecfc4a790689a723

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"17b9f-5826f63145921"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
97183
jquery-migrate.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
23 KB
23 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"5bdb-5826f63145921"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
23515
cookie-law-info-public.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/
16 KB
16 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=1.7.6
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0b38483d984a81aafd0a0627636e7a84490e16156c55ea6d68f1b2dfff4afe5e

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Fri, 15 Mar 2019 23:00:40 GMT
server
Apache
etag
"4140-5842a0200cc8e"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
16704
st_insights.js
ws.sharethis.com/button/
21 KB
6 KB
Script
General
Full URL
https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.137.77 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-137-77.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
24de72ecb2a8508ef05a60e3cdac406f1cbf933ec86c2eb22095f82f590c3057

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:43 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
ETag
W/"5cb63433-54f4"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=30348
Connection
keep-alive
Content-Length
6321
Expires
Mon, 06 May 2019 15:26:31 GMT
sharethis.js
platform-api.sharethis.com/js/
91 KB
28 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:43 GMT
Content-Encoding
gzip
ETag
W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
27855
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/
44 KB
44 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 17:30:42 GMT
server
Apache
etag
"b0e9-5270743f5f480"
content-type
image/png
status
200
accept-ranges
bytes
content-length
45289
ZQ-ransomware.jpg
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/05/
14 KB
14 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/05/ZQ-ransomware.jpg?w=305&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
29379bf3aae96b515e5ead9a0326cfaea0eb1a6e17a4f02b1d46f086f1634f3c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 35
date
Mon, 06 May 2019 07:00:43 GMT
x-content-type-options
nosniff
x-bytes-saved
1172
last-modified
Wed, 01 May 2019 20:08:42 GMT
server
nginx
etag
"f582d00d01cc3106"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2019/05/ZQ-ransomware.jpg>; rel="canonical"
content-length
14050
expires
Sat, 01 May 2021 08:08:42 GMT
dmedianet.js
contextual.media.net/
321 KB
105 KB
Script
General
Full URL
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
eaaa879fe82f2e3e6bea79f74275409b7db8d05ec764d46dfb7bfba35adc56be

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
8-4
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0, no-cache, no-store
Transfer-Encoding
chunked
X-MN-W
8-1
Connection
keep-alive, Transfer-Encoding
Expires
Mon, 06 May 2019 07:00:45 GMT
facebook.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
830 B
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 83
date
Mon, 06 May 2019 07:00:44 GMT
x-content-type-options
nosniff
x-bytes-saved
476
last-modified
Mon, 04 Feb 2019 06:42:59 GMT
server
nginx
etag
"ece8a6ef9301c612"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length
830
expires
Wed, 03 Feb 2021 18:42:59 GMT
twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 35
date
Mon, 06 May 2019 07:00:44 GMT
x-content-type-options
nosniff
x-bytes-saved
815
last-modified
Mon, 04 Feb 2019 06:29:20 GMT
server
nginx
etag
"25135197f99e62b3"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length
1082
expires
Wed, 03 Feb 2021 18:29:20 GMT
linkedin.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 52
date
Mon, 06 May 2019 07:00:44 GMT
x-content-type-options
nosniff
x-bytes-saved
442
last-modified
Mon, 04 Feb 2019 06:42:59 GMT
server
nginx
etag
"119bceeb41186dc5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length
1182
expires
Wed, 03 Feb 2021 18:42:59 GMT
reddit.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
2 KB
2 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
9eade11ffd772c4492d46969c94db94238be90cb2fc9ed98b199a64113d33920
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 52
date
Mon, 06 May 2019 07:00:44 GMT
x-content-type-options
nosniff
x-bytes-saved
1047
last-modified
Mon, 04 Feb 2019 06:29:21 GMT
server
nginx
etag
"b1fd028f0df3a4ad"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png>; rel="canonical"
content-length
1566
expires
Wed, 03 Feb 2021 18:29:21 GMT
pinterest.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
2 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
3afe47d0fe0b16bc5bddecdc9bcaca94ed420b8fd0ddee2ae77364403c794bb8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 52
date
Mon, 06 May 2019 07:00:44 GMT
x-content-type-options
nosniff
x-bytes-saved
1227
last-modified
Mon, 04 Feb 2019 06:29:18 GMT
server
nginx
etag
"9a8b1a5335d6cfb5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png>; rel="canonical"
content-length
1502
expires
Wed, 03 Feb 2021 18:29:18 GMT
f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/
1 KB
1 KB
Image
General
Full URL
https://secure.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Mon, 06 May 2019 07:00:45 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
16776383
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
content-length
1186
expires
Mon, 06 May 2019 07:05:45 GMT
Retefe-trojan.png
securityaffairs.co/wordpress/wp-content/uploads/2019/05/
335 KB
336 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2019/05/Retefe-trojan.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
22a1018e44537189e03dd5ffd83f6197787e43eeee0f9f939d16ce1b9a69af80

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
last-modified
Sun, 05 May 2019 11:59:37 GMT
server
Apache
etag
"53dcf-58822b7d07d42"
content-type
image/png
status
200
accept-ranges
bytes
content-length
343503
Tor-Browser-addons-disabled-2.jpg
securityaffairs.co/wordpress/wp-content/uploads/2019/05/
58 KB
58 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2019/05/Tor-Browser-addons-disabled-2.jpg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f2048ef19dda4cbea2c8f0260c2fae17cf5f6a5fc61984e174896903a0814507

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Sun, 05 May 2019 20:05:36 GMT
server
Apache
etag
"e636-5882981ce379f"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
58934
Digging-The-Deep-Web.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/
6 KB
6 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 67
date
Mon, 06 May 2019 07:00:45 GMT
x-content-type-options
nosniff
x-bytes-saved
43089
last-modified
Mon, 04 Feb 2019 05:57:47 GMT
server
nginx
etag
"279f20454edb33e1"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length
6390
expires
Wed, 03 Feb 2021 17:57:47 GMT
yoroi.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/
6 KB
7 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/yoroi.png?resize=300%2C286&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 67
date
Mon, 06 May 2019 07:00:45 GMT
x-content-type-options
nosniff
x-bytes-saved
13492
last-modified
Mon, 04 Feb 2019 05:58:07 GMT
server
nginx
etag
"0f8e82c107049c26"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2017/06/yoroi.png>; rel="canonical"
content-length
6494
expires
Wed, 03 Feb 2021 17:58:07 GMT
Julian-Assange-arrest.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/04/
5 KB
5 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/04/Julian-Assange-arrest.png?resize=300%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
04dbd00fe7742ceeb538803861574455b1a4ad248d1854247c1aa4abbba28b99
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 83
date
Mon, 06 May 2019 07:00:45 GMT
x-content-type-options
nosniff
x-bytes-saved
176924
last-modified
Wed, 01 May 2019 19:46:09 GMT
server
nginx
etag
"8610eea9c635502a"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2019/04/Julian-Assange-arrest.png>; rel="canonical"
content-length
4768
expires
Sat, 01 May 2021 07:46:09 GMT
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/
105 KB
105 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f18a045b26a9d37b6e3c7a365cf2b72be7cc8711506c3d342c7a2651937db8f1

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Mon, 31 Dec 2018 16:15:58 GMT
server
Apache
etag
"1a45a-57e53ba680b86"
content-type
text/css
status
200
accept-ranges
bytes
content-length
107610
sdk.js
connect.facebook.net/en_US/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
d8ad587ed2c73e68222fbd04dde8cc164760790d75bb9f2e4db909d3ad538a80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
ypLLRXwIOTnhmlNUjEM+BA==
status
200
date
Mon, 06 May 2019 07:00:45 GMT
vary
Accept-Encoding
content-length
1780
x-fb-debug
MtzKzrtgwPbBm4uqoAOWBJF84xF0Z9jKteHA6urmVvWiFL9EUEB5iXHGRukqEiksJ6iVzW5UwtWLvAs5Q8y/wA==
x-fb-content-md5
be84c757c756289fe7a0dd7cc434ed89
etag
"5c67d88c08876f2d8144b8e48c5a45c9"
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 06 May 2019 07:09:44 GMT
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/
1 KB
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20130122
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
87879846a54fe4a250a2a9808103f1ed6943af45e4cbb7f067c44da57c61b3d4

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Thu, 04 Apr 2019 22:02:27 GMT
server
Apache
etag
"562-585bb869a4e8d"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1378
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/
1 KB
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Thu, 02 May 2019 22:30:35 GMT
server
Apache
etag
"40b-587ef2ecb7a65"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1035
devicepx-jetpack.js
s0.wp.com/wp-content/js/
10 KB
3 KB
Script
General
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201919
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT ams 32
date
Mon, 06 May 2019 07:00:44 GMT
content-encoding
gzip
server
nginx
etag
W/"5841a56f-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
2.ams _dfw
expires
Wed, 29 Apr 2020 18:18:09 GMT
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Mon, 31 Dec 2018 16:15:58 GMT
server
Apache
etag
"792-57e53ba684a06"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1938
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
987 B
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"3db-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
987
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
4 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"1113-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
4371
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"1fa1-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8097
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
etag
"a36-526fe6e33f200"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
2614
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
21 KB
21 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 13:55:10 GMT
server
Apache
etag
"53ae-5270441274b80"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
21422
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
etag
"1f6c-526fe6e527680"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8044
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/
69 KB
70 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 13:55:14 GMT
server
Apache
etag
"11571-5270441645480"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
71025
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
11 KB
11 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"2a67-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
10855
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"c18-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3096
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
13 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"3225-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
12837
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
12 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:44 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
etag
"31d4-526fe6e33f200"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
12756
wp-embed.js
securityaffairs.co/wordpress/wp-includes/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"c8e-5826f6315ef61"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3214
e-201919.js
stats.wp.com/
9 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-201919.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Tue, 28 Apr 2020 18:43:18 GMT
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/
25 KB
25 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
7bbd355b4ca50ea670a75269add0ab1d071fb030fb26ab868917078535e78c99

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"64d9-5826f6315ff01"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
25817
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/
9 KB
9 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=16c90ef0abf6cd9c95284f2b86953fb4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"22d2-5826f6315ef61"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8914
css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

5b71b64b04b9a500117b1015.js
buttons-config.sharethis.com/js/
30 B
450 B
Script
General
Full URL
https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:45 GMT
Last-Modified
Mon, 13 Aug 2018 16:48:12 GMT
Server
AmazonS3
x-amz-request-id
F3190FE7D3F18D27
ETag
"e6e1643313740711175f51662a65b42f"
Content-Type
text/javascript
Cache-Control
public, max-age=60
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
30
x-amz-id-2
3LVGY1eJILJq229PLOXfP7IY0dhPGrYacMprkzgkJaYuW8fJk5ZENIMqpOBOAl5CYBQqQ70tYAs=
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 36E8
0
0
Document
General
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.146 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-146.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
c.sharethis.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
ETag
W/"26b-4977387000"
Last-Modified
Tue, 01 Jan 1980 00:00:00 GMT
Vary
Accept-Encoding
Content-Length
334
Cache-Control
public, max-age=3600
Date
Mon, 06 May 2019 07:00:45 GMT
Connection
keep-alive
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/
43 KB
44 KB
Font
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Origin
https://securityaffairs.co

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
last-modified
Wed, 16 Dec 2015 06:58:09 GMT
server
Apache
etag
"ad90-526fe6dc92240"
content-type
application/font-woff
status
200
accept-ranges
bytes
content-length
44432
sdk.js
connect.facebook.net/en_US/
194 KB
58 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=9e1582972ed8e411a3107be041d18701&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
3535856a38b64f2cb17dacb3a0b1e82bed15ee8fb95c188941add8564271b176
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
XkDUAIP+vghOUoTtFBsr4A==
status
200
date
Mon, 06 May 2019 07:00:45 GMT
vary
Accept-Encoding
content-length
59147
x-fb-debug
3WCSKbxYMT45R8mA0iusVmXs8i0DDVUXBPn4M13r+4lBF7YAEF+uBaIHbJKWpE5bSaiXmP+yqFCc0+zxRNWZ7w==
x-fb-content-md5
c89bc94cf751a27f56947e796410b891
etag
"c508a25f718c83d911f7171f1a3b4009"
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
expires
Tue, 05 May 2020 05:23:58 GMT
d_vbiawPdxB.js
staticxx.facebook.com/connect/xd_arbiter/r/ Frame F157
0
0
Document
General
Full URL
https://staticxx.facebook.com/connect/xd_arbiter/r/d_vbiawPdxB.js?version=44
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=9e1582972ed8e411a3107be041d18701&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
staticxx.facebook.com
:scheme
https
:path
/connect/xd_arbiter/r/d_vbiawPdxB.js?version=44
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html

Response headers

status
200
content-type
text/html; charset=utf-8
expires
Fri, 01 May 2020 19:25:44 GMT
strict-transport-security
max-age=15552000; preload
content-encoding
br
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
cache-control
public,max-age=31536000,immutable
x-fb-debug
JhGJQ6YSAwkHXxz+4zsGhPCNIjIGgyektPwERJTheymHR4lt5Obopd9JnpSOqrY0Ibal242Hd2j6mkCKanOkLQ==
content-length
10997
date
Mon, 06 May 2019 07:00:45 GMT
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16a8bf1dd0b-462970cb-1&sessionID=1557126044940.46545&hostname=securityaffairs.co&location=%2Fwordpress%2F84768%2...
  • https://l.sharethis.com/sc?cm=ZGAP61zP250AAAASA34CAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sop=false
0
-1 B
XHR
General
Full URL
https://l.sharethis.com/sc?cm=ZGAP61zP250AAAASA34CAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sop=false
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.194.147 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:45 GMT
Location
/sc?cm=ZGAP61zP250AAAASA34CAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sop=false
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
199
Stid
ZGAP61zP250AAAASA34CAw==

Redirect headers

Date
Mon, 06 May 2019 07:00:45 GMT
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZGAP61zP250AAAASA34CAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sop=false
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
199
Stid
ZGAP61zP250AAAASA34CAw==
sc
l.sharethis.com/
51 B
476 B
XHR
General
Full URL
https://l.sharethis.com/sc?cm=ZGAP61zP250AAAASA34CAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&sop=false
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.194.147 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
6f3c7f3da3163f6978df2874b97946d6a5049433811627867d7206d93cf584f6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

Date
Mon, 06 May 2019 07:00:45 GMT
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGAP61zP250AAAASA34CAw==
Access-Control-Allow-Headers
*
Content-Length
51
Cookie set checksync.php
contextual.media.net/ Frame 3AE8
0
0
Document
General
Full URL
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109&rtime=6&https=1&gdpr=1&gdprconsent=2
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
contextual.media.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Accept-Encoding
gzip, deflate, br
Cookie
gdpr_status=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html

Response headers

Server
Apache
Content-Type
text/html; charset=UTF-8
Set-Cookie
gdpr_status=1; Expires=Thu, 07 Nov 2019 07:00:45 GMT; domain=.media.net; Path=/; visitor-id=2001276450728458000V10; Expires=Tue, 05 May 2020 07:00:45 GMT; domain=.media.net; Path=/;
X-MNET-HL2
E
P3P
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=28396
Expires
Mon, 06 May 2019 14:54:01 GMT
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Length
6521
Connection
keep-alive
rtbsmpubs.php
contextual.media.net/
2 KB
1 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&cid=8HB41O6BH&ptrid=8PREB0781&requestString=170605770*4%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*97%7C300x250%7C8CU5BD6EW%7C762221962&crid=170605770&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=416704850944637851557126045302&erTr=0&hlt=1&ugd=4&tr=0.15942459922197405&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A3153%7D&itype=HB-CM&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0fc1137940d62cf347a3f59e014930ae8a3f8c11b04d4bdf974562c33408abb6

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
877
X-MNET-HL2
E
Expires
Mon, 06 May 2019 07:00:45 GMT
fcmdynet.js
contextual.media.net/ Frame 2480
40 KB
15 KB
Script
General
Full URL
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045302438562&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a46762ced7d8da8de2110d4ac5112d9b19dd6b71f63ada04e1ab7bbb4eadb5f6

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
X-MN-W
12-10
Connection
keep-alive
Content-Length
14775
X-MNET-HL2
8-6
Expires
Mon, 06 May 2019 07:00:45 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 87E3
32 KB
11 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
cfe9da3b6a6de621b733dca24b80ce3dec0ac79ab9daa427b2605b174a45d048
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"157 / 401 of 1000 / last-modified: 1556837274"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10664
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
rtbsmpubs.php
contextual.media.net/
2 KB
1 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&cid=8HB41O6BH&ptrid=8PREB0781&requestString=512365842*4%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*97%7C300x250%7C8CU5BD6EW%7C184323154&crid=512365842&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=366448598211181141557126045321&erTr=0&hlt=1&ugd=4&tr=0.4600975701108061&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A3177%7D&itype=HB-CM&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid4S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
16cfbb298162bef9b3650dcdb4af23609e4f97dd25f73e1f6ad25e876c966475

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
871
X-MNET-HL2
E
Expires
Mon, 06 May 2019 07:00:45 GMT
fcmdynet.js
contextual.media.net/ Frame 28BA
40 KB
15 KB
Script
General
Full URL
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045438324636&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2e477bc51d2e2c5c39d6c71586d6d60c1b7258ac34e6ae4ee4919eb53174e1f2

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
X-MN-W
12-5
Connection
keep-alive
Content-Length
14767
X-MNET-HL2
8-6
Expires
Mon, 06 May 2019 07:00:45 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame D076
32 KB
11 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
cfe9da3b6a6de621b733dca24b80ce3dec0ac79ab9daa427b2605b174a45d048
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"157 / 591 of 1000 / last-modified: 1556837274"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10664
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
rtbsmpubs.php
contextual.media.net/
2 KB
1 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&cid=8HB41O6BH&ptrid=8PREB0781&requestString=555212031*4%7C300x600%7C8CU5BD6EW%7C639665355%40555212031*97%7C300x600%7C8CU5BD6EW%7C639665355&crid=555212031&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=100579923872894161557126045343&erTr=0&hlt=1&ugd=4&tr=0.1205048460517244&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A3177%7D&itype=HB-CM&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid5S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ad359edafd33e8501bcc154748555d6671e33250ab71b598d99083533f4c8980

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
903
X-MNET-HL2
E
Expires
Mon, 06 May 2019 07:00:45 GMT
fcmdynet.js
contextual.media.net/ Frame B779
40 KB
15 KB
Script
General
Full URL
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045319500751&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bc2ff4eb7e6925b51649b8cd87619c995dec3ddd0c5ed11f2f1fdc2e0de08856

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
X-MN-W
12-16
Connection
keep-alive
Content-Length
14748
X-MNET-HL2
8-6
Expires
Mon, 06 May 2019 07:00:45 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame A647
32 KB
11 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
cfe9da3b6a6de621b733dca24b80ce3dec0ac79ab9daa427b2605b174a45d048
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"157 / 680 of 1000 / last-modified: 1556837274"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10664
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
bping.php
lg3.media.net/
35 B
280 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&vi=1557126045302438562&ugd=4&lf=6&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&cc=DE&sc=HE&lper=100&wsip=2886780935&r=1557126045284&vgd_sbSup=1&vgd_isAmp=0&vgd_asn=9009&vgd_nvLogging=0&hvsid=00001557126045280015095070721769
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:45 GMT
bping.php
lg3.media.net/
35 B
280 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1557126045438324636&ugd=4&lf=6&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&cc=DE&sc=HE&lper=100&wsip=2886780935&r=1557126045320&vgd_sbSup=1&vgd_isAmp=0&vgd_asn=9009&vgd_nvLogging=0&hvsid=00001557126045319015095070725387
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:45 GMT
bping.php
lg3.media.net/
35 B
280 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&vi=1557126045319500751&ugd=4&lf=6&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&cc=DE&sc=HE&lper=100&wsip=2886780935&r=1557126045341&vgd_sbSup=1&vgd_isAmp=0&vgd_asn=9009&vgd_nvLogging=0&hvsid=00001557126045334015095070726925
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:45 GMT
/
securityaffairs.co/wordpress/
Redirect Chain
  • https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script
  • https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
493 B
470 B
XHR
General
Full URL
https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.17
Resource Hash
529a8625b1d79f8a672375f5acdefd683f86f29327461266fa428aa734cb697b

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
server
Apache
x-powered-by
PHP/7.2.17
vary
Accept-Encoding,Cookie
content-type
text/html; charset=UTF-8

Redirect headers

status
301
date
Mon, 06 May 2019 07:00:45 GMT
server
Apache
content-length
282
location
https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
content-type
text/html; charset=iso-8859-1
g.gif
pixel.wp.com/
50 B
92 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A7.2.1&blog=29506073&post=84768&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=2638&rand=0.3570708360043753
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 06 May 2019 07:00:45 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
integrator.js
adservice.google.de/adsid/ Frame 87E3
109 B
481 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 87E3
109 B
481 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
pubads_impl_2019043001.js
securepubads.g.doubleclick.net/gpt/ Frame 87E3
150 KB
55 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
sffe /
Resource Hash
e7b43567491c251c9cd052c69fe953de1b1e8a86ad15fafc20692b513bc4e49d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Apr 2019 10:44:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
55804
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
integrator.js
adservice.google.de/adsid/ Frame A647
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame A647
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
pubads_impl_2019043001.js
securepubads.g.doubleclick.net/gpt/ Frame A647
150 KB
55 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
sffe /
Resource Hash
e7b43567491c251c9cd052c69fe953de1b1e8a86ad15fafc20692b513bc4e49d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Apr 2019 10:44:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
55804
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
integrator.js
adservice.google.de/adsid/ Frame D076
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame D076
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
0
pubads_impl_2019043001.js
securepubads.g.doubleclick.net/gpt/ Frame D076
150 KB
55 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
sffe /
Resource Hash
e7b43567491c251c9cd052c69fe953de1b1e8a86ad15fafc20692b513bc4e49d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Apr 2019 10:44:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
55804
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
nrrV814.js
contextual.media.net/__media__/js/util/ Frame 28BA
62 KB
21 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV814.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&nse=3&vi=1557126045438324636&lw=1&ugd=4&re=1&rtbs=1&hlt=1&dfp=1&nb=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
996e2bd6c3db848a6f32276dfd19b6976021c265363d262335df542f3bacc0d8

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
max-age=2592000
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
8-6
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
20897
Expires
Mon, 20 May 2019 07:00:45 GMT
mediamain.html
contextual.media.net/ Frame 89CE
48 KB
13 KB
Script
General
Full URL
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8POV70GQX&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1557126045438324636&lw=1&ugd=4&ib=0&katid=801333254&katbid=-21&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cce2fef869e6e5cfdc5bc02f8ba3ba4aa09c0b0e0af53cf8d498e6d188080fcf

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:45 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
X-MNET-HL3
8-2
X-MN-W
12-1
Connection
keep-alive
Content-Length
12840
Expires
Mon, 06 May 2019 07:00:45 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 87E3
3 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3057045056040906&correlator=1067012124725747&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21062833%2C21063606%2C953563516&vrg=2019043001&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-33&iu=%2F45361917%2F8CU5BD6EW-762221962-300x250_inside_post&sz=300x250&scp=crid%3D762221962%26mnet_segment%3D0.66%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DDE%26mnet_bucketid%3Db3%26mnet_ref_ybn%3D1%26PubMaticSS%3D1610%26RubiconSS%3D2209&eri=4&cookie_enabled=1&bc=15&lmt=1557126045&dt=1557126045707&dlt=1557126045315&idt=356&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=320&ady=1614&adk=3177995050&uci=6rcj552lm3b&ifi=1&ifk=712550141&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&blev=1&bisch=1&ga_vid=130320130.1557126046&ga_sid=1557126046&ga_hid=610661253&fws=256
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
cafe /
Resource Hash
da3f578ba5e2816aa96b26137eeac0ca5ce229c875fdaffdc580d8a6b1dedce6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
2049
x-xss-protection
0
google-lineitem-id
731772677
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
33134140517
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019043001.js
securepubads.g.doubleclick.net/gpt/ Frame 87E3
71 KB
27 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019043001.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
sffe /
Resource Hash
12a0b01fda65dafdfecf773d1e3882c97a31562463aef37b93ece475f3412033
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Apr 2019 10:44:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27457
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame 87E3
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-33/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

mediamain.html
contextual.media.net/ Frame 9697
57 KB
15 KB
Script
General
Full URL
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8POV70GQX&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1557126045302438562&lw=1&ugd=4&ib=0&katid=800496418&katbid=-21&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e26c7e92fb9fc980b4b82ade8a770b8ebffab3efbe954602020e6a671d78323d

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
X-MNET-HL3
8-2
X-MN-W
12-10
Connection
keep-alive
Content-Length
14568
Expires
Mon, 06 May 2019 07:00:46 GMT
mediamain.html
contextual.media.net/ Frame C68A
72 KB
16 KB
Script
General
Full URL
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8POV70GQX&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=hmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=DE&bf=0&staticIframe=1&vif=1&nse=3&vi=1557126045319500751&lw=1&ugd=4&ib=0&katid=801333013&katbid=-21&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2f096389f4d4d2abef93aa8eadff035a2b33ca268bc7bd476f4615768b52df4c

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
X-MNET-HL3
8-2
X-MN-W
12-4
Connection
keep-alive
Content-Length
16147
Expires
Mon, 06 May 2019 07:00:46 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame D076
3 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1327994584010234&correlator=2735650808839572&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&vrg=2019043001&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-33&iu=%2F45361917%2F8CU5BD6EW-184323154-Single_post_ads&sz=300x250&scp=crid%3D184323154%26mnet_segment%3D0.35%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DDE%26mnet_bucketid%3Db3%26mnet_ref_ybn%3D1%26PubMaticSS%3D1610%26RubiconSS%3D2209&eri=4&cookie_enabled=1&bc=15&lmt=1557126045&dt=1557126045775&dlt=1557126045329&idt=297&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=973&ady=413&adk=2598375999&uci=31bl4ov8vrc9&ifi=1&ifk=712550141&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&blev=1&bisch=1&ga_vid=183292715.1557126046&ga_sid=1557126046&ga_hid=1393587619&fws=256
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
cafe /
Resource Hash
360d2a25395df589d139f13da8d151c2a38674812d3a0b07477bcffa96af3557
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
2013
x-xss-protection
0
google-lineitem-id
731764757
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
33134143277
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019043001.js
securepubads.g.doubleclick.net/gpt/ Frame D076
71 KB
27 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019043001.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
sffe /
Resource Hash
12a0b01fda65dafdfecf773d1e3882c97a31562463aef37b93ece475f3412033
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Apr 2019 10:44:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27457
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame D076
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-33/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

ads
securepubads.g.doubleclick.net/gampad/ Frame A647
4 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3840733072747349&correlator=1272730183294932&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21063505%2C370204059%2C953563516&vrg=2019043001&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-33&iu=%2F45361917%2F8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&sz=300x600&scp=crid%3D639665355%26mnet_segment%3D0.51%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DDE%26mnet_bucketid%3Db3%26mnet_ref_ybn%3D1%26PubMaticSS%3D1610%26RubiconSS%3D2209&eri=4&cookie_enabled=1&bc=15&lmt=1557126045&dt=1557126045786&dlt=1557126045356&idt=372&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adx=973&ady=1639&adk=2891760302&uci=7u7arv4e9zj8&ifi=1&ifk=712569323&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&blev=1&bisch=1&ga_vid=1360775364.1557126046&ga_sid=1557126046&ga_hid=146788611&fws=256
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
cafe /
Resource Hash
47b102f2d98f0aab63c1deda50a3abbbd0547786d0e38bf6f8616241ea4b4c33
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
2035
x-xss-protection
0
google-lineitem-id
731768957
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
35793496517
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019043001.js
securepubads.g.doubleclick.net/gpt/ Frame A647
71 KB
27 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019043001.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
sffe /
Resource Hash
12a0b01fda65dafdfecf773d1e3882c97a31562463aef37b93ece475f3412033
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Apr 2019 10:44:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27457
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:45 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-33/html/ Frame A647
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-33/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=aplog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019043010_597&servname=c8-web-7&gdpr=1&csex=2&csstr=&ugd=4&vid=00001557126045963015095070726084&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=DE&sc=HE&ct=FRANKFURT&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=3434&cl=&__rk=0&app=0&rtype=&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&adj0=0&adj1=0&adj2=0&adj3=0&prvReqId=&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=1&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&ybnca_bbid=&acid=903226702036291471557126045297&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&actltime=213&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&adj0=0&adj1=0&adj2=0&adj3=0&prvReqId=&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&ybnca_bbid=&acid=114152812222689601557126045321&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&actltime=445&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&adj0=0&adj1=0&adj2=0&adj3=0&prvReqId=&crid=555212031&g=0&size=300x600&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&ybnca_bbid=&acid=257536233947285961557126045341&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&actltime=441&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&lper=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&kwrf=&epurl=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
analytics.js
google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
6952
date
Mon, 06 May 2019 05:04:54 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Mon, 06 May 2019 07:04:54 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame AC4A
0
296 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst0JYPeYfBSI8g85saLna6XJH8RfsXHU2MIV8jnlTIafizz8__ef2rYrKBDuKGtgdWNYXIAOCQFspk5gkhPmaWDEFn79sPrih6yXqoQRJSEfKqwbYybdAEAiBFUav1gMDj7BNEkx1czxYn4KjsN3mT-eVCvFNa3I6No-gGITR6VKCWRbRz6CZrfEGnm0Dh5l_tf4eRmEKlUImy5O7dO34hwEJXSXeA0nO4TjJjBQ_Jrzm_zCUbrSOUGxvMLTQTdbD-7hGxmYPAH23Q-qUw6UxeZaDeZINbecVh9cgg&sai=AMfl-YSnCeEOI6-qLFqS85UaFB35TTKFhjFidKqldpQNXzHazPyEIfjXJtRYtgj5U7NlDdqiYgp0Vg9QvQPxC1cdUO1Y4KPEpBJjdKkK8kMQ&sig=Cg0ArKJSzNCDYTKKaNlDEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 06 May 2019 07:00:46 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
nrrV814.js
contextual.media.net/__media__/js/util/ Frame 36FD
62 KB
21 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV814.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
996e2bd6c3db848a6f32276dfd19b6976021c265363d262335df542f3bacc0d8

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
max-age=2592000
Date
Mon, 06 May 2019 07:00:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
8-6
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
20897
Expires
Mon, 20 May 2019 07:00:46 GMT
11275_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame 36FD
4 KB
4 KB
Image
General
Full URL
https://contextual.media.net/__media__/images/800000006/11275_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:46 GMT
Last-Modified
Tue, 30 Jan 2018 08:15:37 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4097
Expires
Mon, 20 May 2019 07:00:46 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame AC4A
76 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d559ff90127fb1a15d5d979816c626d3f044a8a82cae54f5a6d8faa2b8a68b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1556617735866586"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28690
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame D076
76 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7152dcb01b90c6ed422e5fbf423b3b692320c5070f5c42be9ec4cabf1d936987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1556617735866586"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28664
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019043010_597&servname=c8-web-7&gdpr=1&csex=2&csstr=&ugd=4&vid=00001557126045963015095070726084&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=DE&sc=HE&ct=FRANKFURT&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=3434&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=184323154&prvApiId=8CU5BD6EW&exid=31&pcId=0000EEA&prvReqId=366448598211181141557126045321&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=26&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-4&ltime=443&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.35&cbdp=0.35&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.35&nms=1&di=&dt=O&epc=184323154&ogbdp=0.35&s=1&snm=success&dbf=1&bdata=iurl_l%3D30%7C%7Cbb%3D100%7C%7Cvv%3D0%7C%7Cl2r_b%3D0.09%7C%7Cl2r_sd%3D2019050510%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.07%7C%7Cxgboost_l%3D0%7C%7Cl2r_if_sd%3D2019050223%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D2611349168128%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7CMP%3D.*crypto.*%7C%7Cxgb_sd%3D2019050500%7C%7Crps_b%3D0.2%7C%7Clast%3D0%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D176%7C%7Crps_sd%3D2019050502%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D3%7C%7Curl_l%3D20%7C%7Cbid%3D0.35%7C%7Cxgb_b%3D0.8%7C%7Cvis_l%3D20%7C%7Cdc%3D7%7C%7Cogbid%3D0.35%7C%7Cbflag%3D0&cmpid=&bId=&pcrid=8CU5BD6EW-184323154-19-21&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl.media.net%2Fdfp%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D184323154%26size%3D300x250%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F84768%252Fmalware%252Fzq-ransomware-decryptor.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Crc%3D1%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=373&ybnca_gbid=&ybnca_erpm=0.07&ybnca_vbid=0.07&yogbdp=0.35&yErpmFlag=0&ybnca_bbid=-1.0&acid=114152812222689601557126045321&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=1&spTo=3&top=0&btm=0&lft=0&rght=0&mx_bsBucket=0&mx_GCID=0&mx_bsProfile=1&mx_KBB=0&mx_UC=0&mx_sbp=-10&actltime=445&brf=0&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=%7Cab%3D0%7C&oyaf=0&sbdrid=454&ra_sz=300x250&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&kwrf=&epurl=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=kfk&evtid=rtbstl&b4b=0.35&b97b=0.00&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&domain=securityaffairs.co&apid=2&size=300x250&at=headerBid&auction_id=2&ip=89.249.64.0&crid=512365842&cid=8HB41O6BH&dt=4&bc=0.35&cc=DE&cmw=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5359
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqUdKXSq5SFhe1mpqE9OW6Wn2dypRWSUk4rGNQmkP9tk2sZJGzuwL7Xci27pcoNpvtd1BoWElDEQqwpv0DNhJzB4QBwTnqP76fqo9poZsDRrzk0IlCtIdbiMRR6Zq8UhDCwJV_FI-lCY4dPBOgkKpKlnZbDApmYCv3yeGx3CE0WpA1wmm--E4UIRI21USDS-FI_670QAzJkzDYHHC--djByaQYeoLbzU4itsdJoHVgimQ3B8yu99_jPbWZH6TdQpZH_Dsv72GRE8FAaZlrOt5p3982PWCmV5b5sWgDPpLI&sai=AMfl-YSLgtSTDu4ZH9zXqriuYlEelRJlMPi7kfhSNfLQItN2oY2rDe5vr2aVVwnhmxNL8Lvj0rYaPBTMI4UZgQz9KG8aIrMVDWkzZkfCOxeWYg&sig=Cg0ArKJSzMl8E7bfTezMEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 06 May 2019 07:00:46 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
nrrV814.js
contextual.media.net/__media__/js/util/ Frame 2E40
62 KB
21 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV814.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
996e2bd6c3db848a6f32276dfd19b6976021c265363d262335df542f3bacc0d8

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
max-age=2592000
Date
Mon, 06 May 2019 07:00:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
8-6
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
20897
Expires
Mon, 20 May 2019 07:00:46 GMT
11354_d2e9c37e359ed9ee8ba98baecc5834b2.png
contextual.media.net/__media__/images/800000006/ Frame 2E40
2 KB
2 KB
Image
General
Full URL
https://contextual.media.net/__media__/images/800000006/11354_d2e9c37e359ed9ee8ba98baecc5834b2.png
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0a6b90b75ea7a7ffcf626ab21af202818e7f820e487ba05c122e68c4702a843d

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:46 GMT
Last-Modified
Mon, 12 Feb 2018 11:51:32 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2049
Expires
Mon, 20 May 2019 07:00:46 GMT
bullet1.woff
contextual.media.net/__media__/fonts/bullet1/ Frame 2E40
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet1/bullet1.woff
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

Date
Mon, 06 May 2019 07:00:46 GMT
Last-Modified
Mon, 16 May 2016 10:39:41 GMT
Server
Apache
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1792
Expires
Tue, 07 May 2019 07:00:46 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 5359
76 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d559ff90127fb1a15d5d979816c626d3f044a8a82cae54f5a6d8faa2b8a68b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1556617735866586"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28690
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame 87E3
76 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7152dcb01b90c6ed422e5fbf423b3b692320c5070f5c42be9ec4cabf1d936987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1556617735866586"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28664
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019043010_597&servname=c8-web-7&gdpr=1&csex=2&csstr=&ugd=4&vid=00001557126045963015095070726084&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=DE&sc=HE&ct=FRANKFURT&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=3434&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=762221962&prvApiId=8CU5BD6EW&exid=31&pcId=0000EEA&prvReqId=416704850944637851557126045302&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=36&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-7&ltime=199&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.66&cbdp=0.66&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.66&nms=1&di=&dt=O&epc=762221962&ogbdp=0.66&s=1&snm=success&dbf=1&bdata=iurl_l%3D30%7C%7Cbb%3D100%7C%7Cvv%3D0%7C%7Cl2r_b%3D0.09%7C%7Cl2r_sd%3D2019050510%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.07%7C%7Cxgboost_l%3D0%7C%7Cl2r_if_sd%3D2019050223%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D2611349168128%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7CMP%3D.*crypto.*%7C%7Cxgb_sd%3D2019050500%7C%7Crps_b%3D0.2%7C%7Clast%3D0%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D176%7C%7Crps_sd%3D2019050502%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D3%7C%7Curl_l%3D20%7C%7Cbid%3D0.66%7C%7Cxgb_b%3D0.8%7C%7Cvis_l%3D20%7C%7Cdc%3D7%7C%7Cogbid%3D0.66%7C%7Cbflag%3D0&cmpid=&bId=&pcrid=8CU5BD6EW-762221962-19-6&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl.media.net%2Fdfp%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D762221962%26size%3D300x250%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F84768%252Fmalware%252Fzq-ransomware-decryptor.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Crc%3D1%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=672&ybnca_gbid=&ybnca_erpm=0.07&ybnca_vbid=0.07&yogbdp=0.66&yErpmFlag=0&ybnca_bbid=-1.0&acid=903226702036291471557126045297&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=1&spTo=3&top=0&btm=0&lft=0&rght=0&mx_bsBucket=0&mx_GCID=0&mx_bsProfile=1&mx_KBB=0&mx_UC=0&mx_sbp=-10&actltime=213&brf=0&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=%7Cab%3D0%7C&oyaf=0&sbdrid=454&ra_sz=300x250&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&kwrf=&epurl=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=kfk&evtid=rtbstl&b4b=0.66&b97b=0.00&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&domain=securityaffairs.co&apid=2&size=300x250&at=headerBid&auction_id=1&ip=89.249.64.0&crid=170605770&cid=8HB41O6BH&dt=4&bc=0.66&cc=DE&cmw=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 14C8
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6Qg-JDTZdDeaI4rRJVHcI0on6AEOca9bDX4vYjboBVXOPKvYaNZhwayeeHvQ-iR-VwFf_PyAr7AqvsopJOB_HDbWer2WGCtgeKj1d6Nc6oIh0xvulfSMRW5hQbrEZyLVjnt79LecY_MyZdSv9N2Y0-9EQF58rwqBA7wOfmiSKnlFqgkTr6NIzvVAPmpAWON4m9RQtMPN_iSUfAurrgvVtkd3itRmPloGR0jPd3SDbkG4GlfAm7PquSXkoKMrGq5uLeW6i4zSTsntpr523QOS2_DKEAVGzxZDKGBYGG-ItqZn8gzq0eVLK9LFf8w&sai=AMfl-YRuNoEGXnUxH10Ur-XoSnB_E_OpVb-3O_tqlp7096UvAPp4BgqtfNHkn7cQ_1Q84c5phHhmFciimeEaXbbM8qYkyu57yYL_P_iWGiOh&sig=Cg0ArKJSzDuE8C3GDzgSEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.130 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 06 May 2019 07:00:46 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
nrrV814.js
contextual.media.net/__media__/js/util/ Frame F582
62 KB
21 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV814.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
996e2bd6c3db848a6f32276dfd19b6976021c265363d262335df542f3bacc0d8

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
max-age=2592000
Date
Mon, 06 May 2019 07:00:46 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
8-6
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
20897
Expires
Mon, 20 May 2019 07:00:46 GMT
10430_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame F582
4 KB
4 KB
Image
General
Full URL
https://contextual.media.net/__media__/images/800000006/10430_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 07:00:46 GMT
Last-Modified
Wed, 25 Oct 2017 09:01:20 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4097
Expires
Mon, 20 May 2019 07:00:46 GMT
bullet13.woff
contextual.media.net/__media__/fonts/bullet13/ Frame F582
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet13/bullet13.woff
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.97 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-97.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6139b4d0af528ec1d0e26ae865c1ca04ac061d844ffa6ccc9e4adaa3af93a2f7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co

Response headers

Date
Mon, 06 May 2019 07:00:46 GMT
Last-Modified
Mon, 16 May 2016 10:39:41 GMT
Server
Apache
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1692
Expires
Tue, 07 May 2019 07:00:46 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 14C8
76 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d559ff90127fb1a15d5d979816c626d3f044a8a82cae54f5a6d8faa2b8a68b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1556617735866586"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28690
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame A647
76 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019043001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7152dcb01b90c6ed422e5fbf423b3b692320c5070f5c42be9ec4cabf1d936987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 07:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1556617735866586"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
28664
x-xss-protection
0
expires
Mon, 06 May 2019 07:00:46 GMT
log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019043010_597&servname=c8-web-7&gdpr=1&csex=2&csstr=&ugd=4&vid=00001557126045963015095070726084&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=DE&sc=HE&ct=FRANKFURT&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=3434&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=639665355&prvApiId=8CU5BD6EW&exid=31&pcId=0000EEA&prvReqId=100579923872894161557126045343&crid=555212031&g=0&size=300x600&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-17&ltime=438&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.51&cbdp=0.51&ckfl=1&cs=&mnet_ckfl=1&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.51&nms=1&di=&dt=O&epc=639665355&ogbdp=0.51&s=1&snm=success&dbf=1&bdata=iurl_l%3D30%7C%7Cbb%3D100%7C%7Cvv%3D1%7C%7Cl2r_b%3D0.09%7C%7Cl2r_sd%3D2019050510%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.07%7C%7Cxgboost_l%3D0%7C%7Cl2r_if_sd%3D2019050223%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D1511837540352%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7CMP%3D.*crypto.*%7C%7Cxgb_sd%3D2019050500%7C%7Crps_b%3D0.2%7C%7Clast%3D0%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D176%7C%7Crps_sd%3D2019050502%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D3%7C%7Curl_l%3D20%7C%7Cbid%3D0.51%7C%7Cxgb_b%3D0.97%7C%7Cvis_l%3D20%7C%7Cdc%3D7%7C%7Cogbid%3D0.51%7C%7Cbflag%3D0&cmpid=&bId=&pcrid=8CU5BD6EW-639665355-19-8&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl.media.net%2Fdfp%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D639665355%26size%3D300x600%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F84768%252Fmalware%252Fzq-ransomware-decryptor.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Crc%3D1%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=450&ybnca_gbid=&ybnca_erpm=0.07&ybnca_vbid=0.07&yogbdp=0.51&yErpmFlag=0&ybnca_bbid=-1.0&acid=257536233947285961557126045341&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=1&spTo=3&top=0&btm=0&lft=0&rght=0&mx_bsBucket=0&mx_GCID=0&mx_bsProfile=1&mx_KBB=0&mx_UC=0&mx_sbp=-10&actltime=441&brf=0&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=%7Cab%3D0%7C&oyaf=0&sbdrid=454&ra_sz=300x600&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&kwrf=&epurl=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
log
hbx-lg.media.net/
35 B
319 B
Image
General
Full URL
https://hbx-lg.media.net/log?logid=kfk&evtid=rtbstl&b4b=0.51&b97b=0.00&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&domain=securityaffairs.co&apid=2&size=300x600&at=headerBid&auction_id=3&ip=89.249.64.0&crid=555212031&cid=8HB41O6BH&dt=4&bc=0.51&cc=DE&ext_user_id=2001276450728458&cmw=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache Tomcat
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Mon, 06 May 2019 07:00:46 GMT
collect
www.google-analytics.com/r/
35 B
111 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1657433843&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&ul=en-us&de=UTF-8&dt=Victims%20of%20ZQ%20Ransomware%20can%20decrypt%20their%20files%20for%20freeSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=815661905&gjid=786017017&cid=1700642624.1557126046&tid=UA-59069958-1&_gid=2120595981.1557126046&_r=1&z=714477931
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 07:00:46 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
bql.php
lg3.media.net/ Frame 36FD
15 B
355 B
Script
General
Full URL
https://lg3.media.net/bql.php?v=1&gdpr=1&hvsid=00001557126045319015095070725387&geo=50.12|8.68&lper=100&bdrid=4&subBdr=454&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5b7TJFvM-vag4n7XiFUueKoWhMrHb2YLAiUblD3lN2vLecfav2v4dkQHoy1jiUYhQCPRwVii5BqC5UW0Kd1vOctTFMLn7ZZoQB&lpid=&tsid=1&ksu=207&q=&prv=&type=&ps=&cme=fl3c56yKPILpznJxksfhQMtSksvqVuEfnRXsKadYTDnaVGkArV6toZCp8Uh3jbJt5QG-EXNYpntkJ4L0iimnCdsEwGci79ffWW-T3F3Tpt49b0GRcsVmXC-kmKgt1zrzSv_tipLeSQauSr_a7ENwmt3YMNWqALX5JBCCHBM0g6oOeo6Y1rYUzworOTM45cgx3ZfFAqpfGaxskON_C-NH3P8cnZkiqD6S%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7CGUvPyzENWc119558QZ-3clu8tKejgvjZzYH30QMhL8eF_BH3BWJxAD_mMpRjmuUXUQJZU9ppAr2NfXGnjO4hQsLliCtpBVpqX1wItpK8UkLa4aF27544bjML7XOKmZDWYoq5gXFQymXBwwDmf9Xd5Amw8FbLR_aEK0x_JEOnxkMRsztrqx6o4DByFK6E5nMC2Xjo16AY5P0%3D%7C&hint=&td=&cc=DE&wsip=2886952062&bca=0&ugd=4&&rc=0&vgd_aid=114152812222689601557126045321&fdkt=344&kwd[]=Tricks%20to%20Prevent%20Ransomware&kwt[]=344&kbc[]=1906321&kwp[]=1&kid[]=326730317&kbc2[]=topics%3D1906321%7C20901%7C%7Cir%3D1%7C%7Ciid%3D1762301%7C%7Cps%3D0.734%7C%7Crpc%3D0.60%7C%7Clvl%3D1.00&ktd[]=278401188096&kwd[]=Open%20Rar%20File%20Free&kwt[]=410&kbc[]=500509&kwp[]=2&kid[]=211248518&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D312886%7C%7Cps%3D0.719%7C%7Crpc%3D0.56%7C%7Clvl%3D1.00&ktd[]=576463228654207232&kwd[]=Unzip%20a%20File&kwt[]=410&kbc[]=500520&kwp[]=3&kid[]=29437887&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D161461%7C%7Cps%3D0.719%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=576463778410021120&kwd[]=Open%207Z%20File&kwt[]=410&kbc[]=500520&kwp[]=4&kid[]=215539494&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D906502%7C%7Cps%3D0.719%7C%7Crpc%3D0.19%7C%7Clvl%3D1.89&ktd[]=576461029614272768&kwd[]=File%20Extension&kwt[]=410&kbc[]=500520&kwp[]=5&kid[]=10776187&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D1908833%7C%7Cps%3D0.719%7C%7Crpc%3D0.63%7C%7Clvl%3D1.00&ktd[]=576463229711171840&rand=1557126046289&cid=8CU5BD6EW&vwid=1557126045438324636&vi=1557126045438324636&l3ch=0&slnkp=no&bdrct=0.35&vgd_rt=447&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&axbx=bl5&vgd_refimp=0&vgd_bdata=iurl_l%3D30%7C%7Cbb%3D100%7C%7Cvv%3D0%7C%7Cl2r_b%3D0.09%7C%7Cl2r_sd%3D2019050510%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.07%7C%7Cxgboost_l%3D0%7C%7Cl2r_if_sd%3D2019050223%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D2611349168128%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7CMP%3D.*crypto.*%7C%7Cxgb_sd%3D2019050500%7C%7Crps_b%3D0.2%7C%7Clast%3D0%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D176%7C%7Crps_sd%3D2019050502%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D3%7C%7Curl_l%3D20%7C%7Cbid%3D0.35%7C%7Cxgb_b%3D0.8%7C%7Cvis_l%3D20%7C%7Cdc%3D7%7C%7Cogbid%3D0.35%7C%7Cbflag%3D0&sttm=1557126045319&upk=1557126045.16397&hvsid=00001557126045319015095070725387&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&npgv=1&rtbsd=10&dytm=1557126045635&matchstring=&matm=1557126046306&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_sc=HE&vgd_l2ch=0&vgd_l1ch=1&vgd_isAmp=0&vgd_katid=801333254&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D13&vgd_kalog=SID%3D12%7C%7CMI%3D1438%7C%7CCI%3D1438%7C%7CMPTD%3D192%7C%7CUUID%3D3LG3qk0rzS791%7C%7CHID%3D15%7C%7CTPTD%3D549797892740%7C%7CSI%3D1438&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A95%2C%22ignoreSessionDisable%22%3Atrue%2C%22both%22%3Afalse%7D%7D&vgd_dfp_tgt=%7B%22crid%22%3A%22184323154%22%2C%22mnet_segment%22%3A%220.35%22%2C%22mnet_variant%22%3A%22454%22%2C%22pub_domain%22%3A%22securityaffairs.co%22%2C%22mnet_cc%22%3A%22DE%22%2C%22mnet_bucketid%22%3A%22b3%22%2C%22mnet_ref_ybn%22%3A1%2C%22PubMaticSS%22%3A%221610%22%2C%22RubiconSS%22%3A%222209%22%7D&vgd_sbSup=1&vgd_l2wsip=2886952194&vgd_nrrv=814&vgd_nrrs=814&vgd_optout=0&vgd_x_pos=973&vgd_y_pos=413&vgd_ren_page_h=3434&vgd_erpm=0.07&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D184323154%26pid%3D8POV70GQX%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%253D%26cme%3DddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%253D%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DDE%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1557126045438324636%26lw%3D1%26ugd%3D4%26ib%3D0%26katid%3D801333254%26katbid%3D-21%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV814.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Mon, 06 May 2019 07:00:46 GMT
log
navvy.media.net/ Frame 36FD
807 B
997 B
Other
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV814.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.193.49.97 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-193-49-97.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 06 May 2019 07:00:46 GMT
server
Jetty(9.4.7.v20170914)
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
max-age=0, no-cache,no-store
content-length
807
expires
Mon, 06 May 2019 07:00:46 GMT
bql.php
lg3.media.net/ Frame 2E40
15 B
355 B
Script
General
Full URL
https://lg3.media.net/bql.php?v=1&gdpr=1&hvsid=00001557126045280015095070721769&geo=50.12|8.68&lper=100&bdrid=4&subBdr=454&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5b7TJFvM-vag4n7XiFUueKoWhMrHb2YLAiUblD3lN2vLecfav2v4dkQHoy1jiUYhQCPRwVii5BqC6eLY-bmxuRdkYCFNmnLdlk&lpid=&tsid=1&ksu=207&q=&prv=&type=&ps=&cme=Feoa5wqV_0SE3XzqW9Ka-y4Rv12PiQ5-Shk9EvX1bWLwTB7o8eItArdK-6rxgjoSJxxeS9NgmZHxipU-5tnJf_G4eKu4w-cU8kDgYu0AQ46GSl-_R02Kb57E6KxPQKklqqgPssLOjOP92ClRrWEJOHS9spdiQUKj6lQqQjKa7_EAfLv_5NFUJaDWIgtBU5Q0NIRhVLaKUShGX-cPMhW2zHWUM4Qf727A%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7CjbKbWtoI3DfQXBh47qSV7Lg4C9H6IjVJedY-3lB8LiZhofS17QDlqcU4xX5ojHC2fo0xCOX6EeSWh5hnEJc_i_7JiHv4epY-DUOSpGBnT9ekqJO7mK93_WspdiJvNEhpCKTwqL4W5NJzlcD7ctJ07ZaV4Y7S07MNo9Idmts7DlvbZ4iGVP56VN3mzqOas5UJvaX5TWauP1s%3D%7C&hint=&td=&cc=DE&wsip=2886952407&bca=0&ugd=4&&rc=0&vgd_aid=903226702036291471557126045297&fdkt=438&kwd[]=Cell%20Phone%20Spy%20Software&kwt[]=438&kbc[]=500985&kwp[]=1&kid[]=58479672&kbc2[]=ir%3D1%7C%7Ciid%3D433935%7C%7Cps%3D0.806%7C%7Crpc%3D0.20%7C%7Clvl%3D1.00&ktd[]=277059076352&kwd[]=Best%20AntiVirus%20for%20Mac&kwt[]=439&kbc[]=1202871521&kwp[]=2&kid[]=3455176&kbc2[]=ir%3D1%7C%7Ciid%3D4988080%7C%7Cps%3D0.880%7C%7Crpc%3D0.16%7C%7Clvl%3D1.00&ktd[]=275717099776&kwd[]=Tricks%20to%20Prevent%20Ransomware&kwt[]=439&kbc[]=1202871521&kwp[]=3&kid[]=326730317&kbc2[]=ir%3D1%7C%7Ciid%3D2139159%7C%7Cps%3D0.880%7C%7Crpc%3D0.60%7C%7Clvl%3D1.00&ktd[]=278401454336&kwd[]=Best%20Anti-Ransomware%20Software&kwt[]=439&kbc[]=1202871521&kwp[]=4&kid[]=326729916&kbc2[]=ir%3D1%7C%7Ciid%3D3756784%7C%7Cps%3D0.880%7C%7Crpc%3D0.54%7C%7Clvl%3D1.00&ktd[]=275700322560&kwd[]=Best%20Antivirus%20Software%20of%202019&kwt[]=439&kbc[]=1202866661&kwp[]=5&kid[]=329721996&kbc2[]=ir%3D1%7C%7Ciid%3D1458379%7C%7Cps%3D0.880%7C%7Crpc%3D0.12%7C%7Clvl%3D2.09&ktd[]=278921548032&rand=1557126046322&cid=8CU5BD6EW&vwid=1557126045302438562&vi=1557126045302438562&l3ch=0&slnkp=no&bdrct=0.66&vgd_rt=218&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&axbx=bl5&vgd_refimp=0&vgd_bdata=iurl_l%3D30%7C%7Cbb%3D100%7C%7Cvv%3D0%7C%7Cl2r_b%3D0.09%7C%7Cl2r_sd%3D2019050510%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.07%7C%7Cxgboost_l%3D0%7C%7Cl2r_if_sd%3D2019050223%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D2611349168128%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7CMP%3D.*crypto.*%7C%7Cxgb_sd%3D2019050500%7C%7Crps_b%3D0.2%7C%7Clast%3D0%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D176%7C%7Crps_sd%3D2019050502%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D3%7C%7Curl_l%3D20%7C%7Cbid%3D0.66%7C%7Cxgb_b%3D0.8%7C%7Cvis_l%3D20%7C%7Cdc%3D7%7C%7Cogbid%3D0.66%7C%7Cbflag%3D0&sttm=1557126045280&upk=1557126045.16397&hvsid=00001557126045280015095070721769&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&rtbsd=10&matchstring=&dytm=1557126045677&matm=1557126046329&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_sc=HE&vgd_l2ch=0&vgd_l1ch=1&vgd_isAmp=0&vgd_katid=800496418&vgd_katbid=-21&vgd_kals=ttype%3D10017%7C%7Cpc%3D32&vgd_kalog=SID%3D12%7C%7CMI%3D1438%7C%7CCI%3D1438%7C%7CMPTD%3D192%7C%7CUUID%3D3LEKajhAfIRgp%7C%7CHID%3D15%7C%7CTPTD%3D549806478212%7C%7CSI%3D1438&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A95%2C%22ignoreSessionDisable%22%3Atrue%2C%22both%22%3Afalse%7D%7D&vgd_dfp_tgt=%7B%22crid%22%3A%22762221962%22%2C%22mnet_segment%22%3A%220.66%22%2C%22mnet_variant%22%3A%22454%22%2C%22pub_domain%22%3A%22securityaffairs.co%22%2C%22mnet_cc%22%3A%22DE%22%2C%22mnet_bucketid%22%3A%22b3%22%2C%22mnet_ref_ybn%22%3A1%2C%22PubMaticSS%22%3A%221610%22%2C%22RubiconSS%22%3A%222209%22%7D&vgd_sbSup=1&vgd_l2wsip=2886952407&vgd_nrrv=814&vgd_nrrs=814&vgd_optout=0&vgd_x_pos=320&vgd_y_pos=1614&vgd_ren_page_h=3434&vgd_erpm=0.07&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D762221962%26pid%3D8POV70GQX%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%253D%26cme%3Dhmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%253D%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DDE%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1557126045302438562%26lw%3D1%26ugd%3D4%26ib%3D0%26katid%3D800496418%26katbid%3D-21%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV814.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Mon, 06 May 2019 07:00:46 GMT
log
navvy.media.net/ Frame 2E40
807 B
997 B
Other
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV814.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.193.49.97 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-193-49-97.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 06 May 2019 07:00:46 GMT
server
Jetty(9.4.7.v20170914)
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
max-age=0, no-cache,no-store
content-length
807
expires
Mon, 06 May 2019 07:00:46 GMT
bql.php
lg3.media.net/ Frame F582
15 B
355 B
Script
General
Full URL
https://lg3.media.net/bql.php?v=1&gdpr=1&hvsid=00001557126045334015095070726925&geo=50.12|8.68&lper=100&bdrid=4&subBdr=454&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5b7TJFvM-vag4n7XiFUueKoWhMrHb2YLAiUblD3lN2vLecfav2v4dkQHoy1jiUYhQCPRwVii5BqC7K_xd7VDSG_LvcaBR-xD17&lpid=&tsid=18&ksu=207&q=&prv=&type=&ps=&cme=_C-Vg5Q9a5HjN128kDEVhTfIjrCXavYbkkwSXj71htXr8b1zYILwRCJUdMKh40Pt2KGdXG_in_HXO_H7IxqACtUShL59R0y6WlbdZm6gIe0r2Debiud71uy_B-pF7tFfwNTh0IQUu0AdhyGBRXTh27RO9-b2gj6vwuBwFo8j6iK4mMpFbWjSRfDx4X3oZF4L1UwLzv3Bhz6YlHcr81N8M3O1bRLgiSQE%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7CiIx-09Viky8yli0uW3tz6yi75vjQe7rg2ijz8ablCKgXpowf6XBbw1zMQXWyzHb1FlzMUotB0AXJbUC7m0YWsCudioVgkHEw_akjKEOKclauhaigWJJQhy57CwkBWJ3wQ7SN5PZYf_Jo4MlWFWaXsNX9WZYkKKMFIx9vwh-UjBBKMN3RDbGM1NiDCzvpW9TL3VrCKOu52EA%3D%7C&hint=&td=&cc=DE&wsip=2886934062&bca=0&ugd=4&&rc=0&vgd_aid=257536233947285961557126045341&fdkt=439&kwd[]=Tricks%20to%20Prevent%20Ransomware&kwt[]=439&kbc[]=1202871521&kwp[]=1&kid[]=326730317&kbc2[]=ir%3D1%7C%7Ciid%3D6534447%7C%7Cps%3D0.880%7C%7Crpc%3D0.60%7C%7Clvl%3D1.00&ktd[]=277059010816&kwd[]=Best%20AntiVirus%20for%20Mac&kwt[]=439&kbc[]=1202871521&kwp[]=2&kid[]=3455176&kbc2[]=ir%3D1%7C%7Ciid%3D5615034%7C%7Cps%3D0.880%7C%7Crpc%3D0.16%7C%7Clvl%3D1.00&ktd[]=275716833536&kwd[]=Best%20Anti-Ransomware%20Software&kwt[]=439&kbc[]=1202871521&kwp[]=3&kid[]=326729916&kbc2[]=ir%3D1%7C%7Ciid%3D3756784%7C%7Cps%3D0.880%7C%7Crpc%3D0.54%7C%7Clvl%3D1.00&ktd[]=275700056320&kwd[]=Free%20Malware%20Removal%20Tools&kwt[]=439&kbc[]=1202866661&kwp[]=4&kid[]=324514078&kbc2[]=ir%3D1%7C%7Ciid%3D5455234%7C%7Cps%3D0.880%7C%7Crpc%3D0.36%7C%7Clvl%3D1.00&ktd[]=277042233600&kwd[]=Online%20Spyware%20Removal&kwt[]=439&kbc[]=1202866661&kwp[]=5&kid[]=21263898&kbc2[]=ir%3D1%7C%7Ciid%3D42200%7C%7Cps%3D0.880%7C%7Crpc%3D0.45%7C%7Clvl%3D1.00&ktd[]=278384410880&kwd[]=Best%20Antivirus%20Software%20of%202019&kwt[]=439&kbc[]=1202866661&kwp[]=6&kid[]=329721996&kbc2[]=ir%3D1%7C%7Ciid%3D5645684%7C%7Cps%3D0.880%7C%7Crpc%3D0.12%7C%7Clvl%3D2.09&ktd[]=275700056320&kwd[]=Best%20Mac%20Antivirus%202019&kwt[]=439&kbc[]=1202866661&kwp[]=7&kid[]=329716295&kbc2[]=ir%3D1%7C%7Ciid%3D4988080%7C%7Cps%3D0.880%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=275700056320&kwd[]=Best%20Malware%20Removal%20Software&kwt[]=439&kbc[]=1202866661&kwp[]=8&kid[]=48906545&kbc2[]=ir%3D2%7C%7Ciid%3D7105718%7C%7Cps%3D0.880%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=277059010816&rand=1557126046423&cid=8CU5BD6EW&vwid=1557126045319500751&vi=1557126045319500751&l3ch=0&slnkp=no&bdrct=0.51&vgd_rt=442&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&axbx=bl5&vgd_refimp=0&vgd_bdata=iurl_l%3D30%7C%7Cbb%3D100%7C%7Cvv%3D1%7C%7Cl2r_b%3D0.09%7C%7Cl2r_sd%3D2019050510%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.07%7C%7Cxgboost_l%3D0%7C%7Cl2r_if_sd%3D2019050223%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D1511837540352%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7CMP%3D.*crypto.*%7C%7Cxgb_sd%3D2019050500%7C%7Crps_b%3D0.2%7C%7Clast%3D0%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D176%7C%7Crps_sd%3D2019050502%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D3%7C%7Curl_l%3D20%7C%7Cbid%3D0.51%7C%7Cxgb_b%3D0.97%7C%7Cvis_l%3D20%7C%7Cdc%3D7%7C%7Cogbid%3D0.51%7C%7Cbflag%3D0&sttm=1557126045334&upk=1557126045.16397&hvsid=00001557126045334015095070726925&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&npgv=1&rtbsd=10&dytm=1557126045745&matchstring=&matm=1557126046432&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_sc=HE&vgd_l2ch=0&vgd_l1ch=1&vgd_isAmp=0&vgd_katid=801333013&vgd_katbid=-21&vgd_kals=ttype%3D10007%7C%7Cpc%3D88&vgd_kalog=MI%3D1438%7C%7CCI%3D1438%7C%7CMPTD%3D192%7C%7CSI%3D1438%7C%7CHID%3D6%7C%7CTPTD%3D549797958404%7C%7CSID%3D12%7C%7CUUID%3D3UkzB6cwXuEVF&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A95%2C%22ignoreSessionDisable%22%3Atrue%2C%22both%22%3Afalse%7D%7D&vgd_dfp_tgt=%7B%22crid%22%3A%22639665355%22%2C%22mnet_segment%22%3A%220.51%22%2C%22mnet_variant%22%3A%22454%22%2C%22pub_domain%22%3A%22securityaffairs.co%22%2C%22mnet_cc%22%3A%22DE%22%2C%22mnet_bucketid%22%3A%22b3%22%2C%22mnet_ref_ybn%22%3A1%2C%22PubMaticSS%22%3A%221610%22%2C%22RubiconSS%22%3A%222209%22%7D&vgd_sbSup=1&vgd_l2wsip=2886928148&vgd_nrrv=814&vgd_nrrs=814&vgd_optout=0&vgd_x_pos=973&vgd_y_pos=1639&vgd_ren_page_h=3434&vgd_erpm=0.07&vgd_rensize=300_600&vgd_scr_h=1200&vgd_scr_w=1600&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D639665355%26pid%3D8POV70GQX%26size%3D300x600%26cpnet%3DyVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%253D%26cme%3Dhmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%253D%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DDE%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1557126045319500751%26lw%3D1%26ugd%3D4%26ib%3D0%26katid%3D801333013%26katbid%3D-21%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A600%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A8
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV814.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Mon, 06 May 2019 07:00:46 GMT
log
navvy.media.net/ Frame F582
807 B
997 B
Other
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV814.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.193.49.97 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-193-49-97.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 06 May 2019 07:00:46 GMT
server
Jetty(9.4.7.v20170914)
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
max-age=0, no-cache,no-store
content-length
807
expires
Mon, 06 May 2019 07:00:46 GMT
bqi.php
lg3.media.net/ Frame 28BA
15 B
15 B
Image
General
Full URL
https://lg3.media.net/bqi.php?&lf=3&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&pid=8POV70GQX&vi=1557126045438324636&hvsid=00001557126045319015095070725387&bdrid=4&subBdr=454&ugd=4&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CkHgNhtscqFCMpktuQdY9wyZ2xfIxzRwYKX8qWCCT-SHXB3E_XAltGy8I8Dmyk7Z0R8HNKauk-8ROwaXcP6B16x-_dUB6dJNn23PkBhEtaWo%3D%7CsRBSg3CPSiQ%3D%7C&cc=DE&sc=HE&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F84768%2Fmalware%2Fzq-ransomware-decryptor.html&l1ch=1&sttm=1557126045319&upk=1557126045.16397&hvsid=00001557126045319015095070725387&verid=3121199&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&npgv=1&rtbsd=10&dytm=1557126045635&l2ch=0&l2wsip=2886952194&katbid=-21&katid=801333254&kapc=13&kals=ttype%3D10002%7C%7Cpc%3D13&kata=aton&kalog=SID%3D12%7C%7CMI%3D1438%7C%7CCI%3D1438%7C%7CMPTD%3D192%7C%7CUUID%3D3LG3qk0rzS791%7C%7CHID%3D15%7C%7CTPTD%3D549797892740%7C%7CSI%3D1438&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&matchstring=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.62.140.165 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 07:00:46 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Mon, 06 May 2019 07:00:46 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=16c90ef0abf6cd9c95284f2b86953fb4
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=16c90ef0abf6cd9c95284f2b86953fb4
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=16c90ef0abf6cd9c95284f2b86953fb4
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=16c90ef0abf6cd9c95284f2b86953fb4

Verdicts & Comments Add Verdict or Comment

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| _wpemojiSettings undefined| $ function| jQuery object| Cli_Data object| log_object object| CLI_Cookie object| CLI string| CLI_ACCEPT_COOKIE_NAME number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus boolean| sop_pview_logged string| stWidgetVersion object| stLight boolean| st_showing object| __stdos__ function| __sharethis__docReady object| __sharethis__ number| cli_flush_cache object| _mNHandle string| medianet_versionId string| cli_cookiebar_settings object| click_object object| FB object| wpcom_img_zoomer object| detectZoom object| wp object| Main object| BrowserDetect object| twemoji object| jQuery112405430449840297644 object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer object| _mN function| setup string| _mN_Idf string| _mN_ctrM number| _mN_ctr object| hbCMBidxc function| _cR function| _cD object| _mNDetails function| _cmL1Require function| _cmL1Define object| _mN_dy function| $j function| imagePreview object| _stq function| st_go function| linktracker_init object| wpcom object| google_reactive_ads_global_state string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

0 Cookies

5 Console Messages

Source Level URL
Text
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 23)
Message:
JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45)
Message:
JQMIGRATE: jQuery.fn.load() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45)
Message:
JQMIGRATE: jQuery.fn.unload() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47)
Message:
console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
connect.facebook.net
contextual.media.net
fonts.googleapis.com
google-analytics.com
hbx-lg.media.net
i0.wp.com
i1.wp.com
i2.wp.com
l.sharethis.com
lg3.media.net
maxcdn.bootstrapcdn.com
navvy.media.net
pixel.wp.com
platform-api.sharethis.com
s0.wp.com
secure.gravatar.com
securepubads.g.doubleclick.net
securityaffairs.co
staticxx.facebook.com
stats.wp.com
tpc.googlesyndication.com
ws.sharethis.com
www.google-analytics.com
www.googletagservices.com
fonts.googleapis.com
172.217.23.130
18.195.194.147
192.0.76.3
192.0.77.2
192.0.77.32
2.16.186.146
2.19.43.118
2001:8d8:100f:f000::289
209.197.3.15
23.210.250.97
23.62.140.165
23.67.137.77
2a00:1450:4001:80b::2002
2a00:1450:4001:814::2004
2a00:1450:4001:816::2002
2a00:1450:4001:819::2001
2a00:1450:4001:81b::200e
2a00:1450:4001:81d::2002
2a03:2880:f01c:216:face:b00c:0:3
2a04:fa87:fffe::c000:4902
54.193.49.97
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
04dbd00fe7742ceeb538803861574455b1a4ad248d1854247c1aa4abbba28b99
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0a6b90b75ea7a7ffcf626ab21af202818e7f820e487ba05c122e68c4702a843d
0b38483d984a81aafd0a0627636e7a84490e16156c55ea6d68f1b2dfff4afe5e
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fc1137940d62cf347a3f59e014930ae8a3f8c11b04d4bdf974562c33408abb6
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
12a0b01fda65dafdfecf773d1e3882c97a31562463aef37b93ece475f3412033
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
16cfbb298162bef9b3650dcdb4af23609e4f97dd25f73e1f6ad25e876c966475
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
22a1018e44537189e03dd5ffd83f6197787e43eeee0f9f939d16ce1b9a69af80
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
24de72ecb2a8508ef05a60e3cdac406f1cbf933ec86c2eb22095f82f590c3057
25828e937e993ca19df9dcecfcacf886ce7777a9918147097153f2710de2ccc6
29379bf3aae96b515e5ead9a0326cfaea0eb1a6e17a4f02b1d46f086f1634f3c
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
2e477bc51d2e2c5c39d6c71586d6d60c1b7258ac34e6ae4ee4919eb53174e1f2
2f096389f4d4d2abef93aa8eadff035a2b33ca268bc7bd476f4615768b52df4c
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
3535856a38b64f2cb17dacb3a0b1e82bed15ee8fb95c188941add8564271b176
360d2a25395df589d139f13da8d151c2a38674812d3a0b07477bcffa96af3557
3afe47d0fe0b16bc5bddecdc9bcaca94ed420b8fd0ddee2ae77364403c794bb8
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
47b102f2d98f0aab63c1deda50a3abbbd0547786d0e38bf6f8616241ea4b4c33
529a8625b1d79f8a672375f5acdefd683f86f29327461266fa428aa734cb697b
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
6139b4d0af528ec1d0e26ae865c1ca04ac061d844ffa6ccc9e4adaa3af93a2f7
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646
6d559ff90127fb1a15d5d979816c626d3f044a8a82cae54f5a6d8faa2b8a68b5
6f3c7f3da3163f6978df2874b97946d6a5049433811627867d7206d93cf584f6
7152dcb01b90c6ed422e5fbf423b3b692320c5070f5c42be9ec4cabf1d936987
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
7bbd355b4ca50ea670a75269add0ab1d071fb030fb26ab868917078535e78c99
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87879846a54fe4a250a2a9808103f1ed6943af45e4cbb7f067c44da57c61b3d4
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
996e2bd6c3db848a6f32276dfd19b6976021c265363d262335df542f3bacc0d8
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9eade11ffd772c4492d46969c94db94238be90cb2fc9ed98b199a64113d33920
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a46762ced7d8da8de2110d4ac5112d9b19dd6b71f63ada04e1ab7bbb4eadb5f6
ad359edafd33e8501bcc154748555d6671e33250ab71b598d99083533f4c8980
aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
bc2ff4eb7e6925b51649b8cd87619c995dec3ddd0c5ed11f2f1fdc2e0de08856
bf59c6832eb9df82772307968b03faa3ed06bf8b2bd2bd994e5ac900e7ac58da
c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
cce2fef869e6e5cfdc5bc02f8ba3ba4aa09c0b0e0af53cf8d498e6d188080fcf
cf98bbd1923f8432df3b6cc078ec3e999a702e7015486591ef4502a359b3ce4c
cfe9da3b6a6de621b733dca24b80ce3dec0ac79ab9daa427b2605b174a45d048
d8ad587ed2c73e68222fbd04dde8cc164760790d75bb9f2e4db909d3ad538a80
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
da3f578ba5e2816aa96b26137eeac0ca5ce229c875fdaffdc580d8a6b1dedce6
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2
e26c7e92fb9fc980b4b82ade8a770b8ebffab3efbe954602020e6a671d78323d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
e7b43567491c251c9cd052c69fe953de1b1e8a86ad15fafc20692b513bc4e49d
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
eaaa879fe82f2e3e6bea79f74275409b7db8d05ec764d46dfb7bfba35adc56be
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f18a045b26a9d37b6e3c7a365cf2b72be7cc8711506c3d342c7a2651937db8f1
f2048ef19dda4cbea2c8f0260c2fae17cf5f6a5fc61984e174896903a0814507
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f42551c6cb1f3a2597f99bdb1b458a5224c04d14de425efc4c1f543bbc1a2570
fa055f2f7c5b735dbbb71954f434aed79925bc00ff2ffbc3ecfc4a790689a723
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f