Report Overview

  1. Submitted URL

    symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buhti-ransomware

  2. IP

    104.22.48.215

    ASN

    #13335 CLOUDFLARENET

  3. Submitted

    2024-05-04 03:11:48

    Access

    public

  4. Website Title

    Buhti: New Ransomware Operation Relies on Repurposed Payloads | Symantec Enterprise Blogs

  5. Final URL

    symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buhti-ransomware

  6. Tags

  7. urlquery detections

    No alerts detected

Detections

  1. urlquery

    0

  2. Network Intrusion Detection

    0

  3. Threat Detection Systems

    4

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
www.google.com71997-09-152015-05-102024-03-23
www.googletagmanager.com752011-11-112013-05-222024-05-02
play.vidyard.com119752011-01-272013-05-292024-05-02
geolocation.onetrust.com8022004-01-122018-02-072024-05-03
www.gstatic.comunknown2008-02-112016-07-262024-05-03
images.sw.broadcom.comunknown1994-05-092022-09-122024-02-21
fonts.gstatic.comunknown2008-02-112014-09-092024-05-03
cdn.cookielaw.org5022011-06-202013-12-282024-05-02
symantec-enterprise-blogs.security.comunknown1994-05-122020-04-092024-03-03
static.cloudflareinsights.com12942019-08-302019-09-242024-05-03

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules
SeverityIndicatorAlert
mediumgeolocation.onetrust.com/cookieconsentpub/v1/geo/locationDetects strings found in Runspace Post Exploitation Toolkit
mediumgeolocation.onetrust.com/cookieconsentpub/v1/geo/locationDetect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

OpenPhish

No alerts detected


PhishTank

No alerts detected


mnemonic secure dns

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


JavaScript (30)

HTTP Transactions (69)

URLIPResponseSize
cdn.cookielaw.org/scripttemplates/otSDKStub.js
104.19.178.52200 OK6.9 kB
cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/OtAutoBlock.js
104.19.178.52200 OK2.8 kB
play.vidyard.com/embed/v4.umd.js
151.101.1.181200 OK50 kB
cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/301196e0-93ad-473e-a572-975514574496.json
104.19.178.52200 OK1.7 kB
cdn.cookielaw.org/scripttemplates/202304.1.0/otBannerSdk.js
104.19.178.52200 OK99 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/globe-americas.svg
104.22.48.215200 OK123 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2024-03/Hero-1435355598.jpg.webp?h=b5e3fcd1&itok=U0Eeei9v
104.22.48.215200 OK13 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2024-05/Hero-1007981330.jpg.webp?h=54e8f53c&itok=mXPtF7Ot
104.22.48.215200 OK20 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_bio_large/public/2017-10/author-profile-default.jpg.webp?h=6386ac74&itok=0czhl3gL
104.22.48.215200 OK21 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_inline_medium/public/2023-05/Ransom_Note_Buhti_0.png.webp?itok=BVxNwMSN
104.22.48.215200 OK36 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2024-02/Hero-1467227409.jpg.webp?h=cb89afd7&itok=HfhI5i6b
104.22.48.215200 OK20 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2024-03/Hero-1420039900.jpg.webp?h=cb89afd7&itok=zejIZxsA
104.22.48.215200 OK15 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_inline_medium/public/2023-05/Fig2_0.png.webp?itok=IJQuf-HF
104.22.48.215200 OK56 kB
cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/0a09381f-7ddd-4fa4-ad16-4a1f1c355336/en.json
104.19.178.52200 OK15 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_avatar_small/public/2017-10/author-profile-default.jpg.webp?h=6386ac74&itok=yMcB1DYB
104.22.48.215200 OK3.9 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_large/public/2023-05/Hero%20-1322943745.jpg.webp?h=d0633ac3&itok=jqwmEquJ
104.22.48.215200 OK586 kB
symantec-enterprise-blogs.security.com/blogs/Metropolis-Medium.2d9d39a57d953c79.woff2
104.22.48.215200 OK17 kB
symantec-enterprise-blogs.security.com/blogs/Metropolis-SemiBold.d2e20fff26a63d07.woff2
104.22.48.215200 OK17 kB
symantec-enterprise-blogs.security.com/blogs/api/v1/blogs/announcement?aid=IOTVy1&sid=0ea78691-3b54-45e2-bd5f-b45ee9a86226
104.22.48.215200 OK59 B
symantec-enterprise-blogs.security.com/blogs/Metropolis-Bold.95361de5b5275a58.woff2
104.22.48.215200 OK17 kB
symantec-enterprise-blogs.security.com/blogs/assets/logo.20230425.svg
104.22.48.215200 OK6.5 kB
geolocation.onetrust.com/cookieconsentpub/v1/geo/location
172.64.155.119200 OK293 kB
symantec-enterprise-blogs.security.com/blogs/api/v1/content-item/by-alias?aid=IOTVy1&alias=blog/threat-intelligence&sid=0ea78691-3b54-45e2-bd5f-b45ee9a86226
104.22.48.215200 OK37 kB
symantec-enterprise-blogs.security.com/blogs/Metropolis-Medium.2d9d39a57d953c79.woff2
104.22.48.215200 OK17 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/envelope.svg
104.22.48.215200 OK894 B
symantec-enterprise-blogs.security.com/blogs/assets/favicon/apple-touch-icon.png
104.22.48.215200 OK4.7 kB
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otFloatingFlat.json
104.19.178.52200 OK2.7 kB
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otCookieSettingsButton.json
104.19.178.52200 OK1.8 kB
symantec-enterprise-blogs.security.com/blogs/api/v1/content-item/by-alias?aid=IOTVy1&alias=blog-post/buhti-ransomware&display-context=221&sid=0ea78691-3b54-45e2-bd5f-b45ee9a86226
104.22.48.215200 OK42 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/compass.svg
104.22.48.215200 OK695 B
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
142.250.74.163200 OK206 kB
images.sw.broadcom.com/Web/CAInc2/%7B0dd907c3-1965-4a46-8bd9-d2137213dc4e%7D_blocked-emails.js
95.101.10.146200 OK24 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_bio_small/public/2017-10/author-profile-default.jpg.webp?h=6386ac74&itok=w8Rg1PQZ
104.22.48.215200 OK3.9 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_tiny/public/2023-05/Hero%20-1322943745.jpg.webp?h=d0633ac3&itok=ZEHkw7hU
104.22.48.215200 OK73 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_inline_small/public/2023-05/Fig2_0.png.webp?itok=Oz5yS8sc
104.22.48.215200 OK33 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_inline_small/public/2023-05/Ransom_Note_Buhti_0.png.webp?itok=eF3inXrV
104.22.48.215200 OK36 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_small/public/2024-03/Hero-1435355598.jpg.webp?h=b5e3fcd1&itok=5CogppJH
104.22.48.215200 OK32 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_small/public/2024-02/Hero-1467227409.jpg.webp?h=cb89afd7&itok=40ITqY5Z
104.22.48.215200 OK63 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_small/public/2024-03/Hero-1420039900.jpg.webp?h=cb89afd7&itok=TQiMybkN
104.22.48.215200 OK48 kB
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_small/public/2024-05/Hero-1007981330.jpg.webp?h=54e8f53c&itok=Fl-lmH-T
104.22.48.215200 OK71 kB
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css
142.250.74.163200 OK25 kB
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
142.250.74.163200 OK206 kB
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
216.58.207.227200 OK15 kB
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
142.250.74.163200 OK206 kB
www.google.com/js/bg/fyCF3lmo_OYnC_9rGWUF-CeQvtOEKKrTUK_XXS1Fd1s.js
142.250.74.132200 OK7.5 kB
www.gstatic.com/recaptcha/api2/logo_48.png
142.250.74.163200 OK2.2 kB
symantec-enterprise-blogs.security.com/cdn-cgi/rum?
104.22.48.215204 No Content0 B
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css
142.250.74.163200 OK25 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/share-alt.svg
104.22.48.215200 OK207 kB
symantec-enterprise-blogs.security.com/blogs/assets/favicon/favicon-16x16.png
104.22.48.215200 OK496 B
www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfqk1EUAAAAALmZHlI0mPZOiPIdZ6gu_91-A49j&co=aHR0cHM6Ly9zeW1hbnRlYy1lbnRlcnByaXNlLWJsb2dzLnNlY3VyaXR5LmNvbTo0NDM.&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=74hhsowk2ji6
142.250.74.132200 OK46 kB
www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6Lfqk1EUAAAAALmZHlI0mPZOiPIdZ6gu_91-A49j
142.250.74.132200 OK7.4 kB
symantec-enterprise-blogs.security.com/blogs/styles.977874cdc9c632a6.css
104.22.48.215200 OK170 kB
cdn.cookielaw.org/scripttemplates/202304.1.0/assets/otCommonStyles.css
104.19.178.52200 OK22 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/check.svg
104.22.48.215200 OK502 B
symantec-enterprise-blogs.security.com/blogs/main.ddb008685495cc54.js
104.22.48.215200 OK628 kB
cdn.cookielaw.org/logos/static/ot_close.svg
104.19.178.52200 OK651 B
symantec-enterprise-blogs.security.com/blogs/runtime.3d45dbe3cf1c9b60.js
104.22.48.215200 OK2.8 kB
static.cloudflareinsights.com/beacon.min.js/vedd3670a3b1c4e178fdfb0cc912d969e1713874337387
104.16.79.73200 OK19 kB
www.google.com/recaptcha/api.js?render=explicit&onload=ng2recaptchaloaded
142.250.74.132200 OK913 B
symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buhti-ransomware
104.22.48.215200 OK66 kB
www.googletagmanager.com/gtm.js?id=GTM-KF7XWD
142.250.74.168200 OK426 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/linkedin.svg
104.22.48.215200 OK667 B
www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m
142.250.74.132200 OK102 B
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/twitter.svg
104.22.48.215200 OK801 B
symantec-enterprise-blogs.security.com/blogs/polyfills.824ad2d7c1c36d3a.js
104.22.48.215200 OK34 kB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/home.svg
104.22.48.215200 OK688 B
symantec-enterprise-blogs.security.com/blogs/api/v1/blogs?aid=IOTVy1&division=fea23926-b4f8-4c9c-9161-6951442b2e6c&sid=0ea78691-3b54-45e2-bd5f-b45ee9a86226
104.22.48.215200 OK1.5 MB
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/search.svg
104.22.48.215200 OK407 B