ocsp.pki.goog/gts1c3
471 B IP
Hash d01fcdf9d07d46c2f636f5d4761b4216
b0b5d955d4da1ad20192a71164d982626c4e723a
77273f261fedd69a83c6bd35f063e592e1aba013c76665a376d2e82a4793e052
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
200 OK 27 kB URL User Request GET HTTP/2 id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
IP
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1818)
Hash f9c61e0794273ec47704e0bf9c8a6211
3d5142fb99dc31995ff987b64a58756aacccbe60
f40e7f1b6dc0783bd8ae8be8802f653244cba9970d86238602b070637c81eb24
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /2017/03/cryptomeister-ransomware.html HTTP/1.1
Host: id-ransomware.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
expires: Sat, 23 Sep 2023 16:24:16 GMT
date: Sat, 23 Sep 2023 16:24:16 GMT
cache-control: private, max-age=0
last-modified: Thu, 21 Sep 2023 00:48:46 GMT
etag: W/"cb073105ed406e1406d72924d2ad7871ebf5dbbe4cb2af92908db0800913b3d2"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 26942
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash d01fcdf9d07d46c2f636f5d4761b4216
b0b5d955d4da1ad20192a71164d982626c4e723a
77273f261fedd69a83c6bd35f063e592e1aba013c76665a376d2e82a4793e052
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
id-ransomware.blogspot.com/js/cookienotice.js
200 OK 6.5 kB URL GET HTTP/3 id-ransomware.blogspot.com/js/cookienotice.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
Hash a705132a2174f88e196ec3610d68faa8
3bad57a48d973a678fec600d45933010f6edc659
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /js/cookienotice.js HTTP/1.1
Host: id-ransomware.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 6513
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Sep 2023 15:23:06 GMT
expires: Tue, 26 Sep 2023 15:23:06 GMT
cache-control: public, max-age=604800
last-modified: Tue, 19 Sep 2023 11:55:25 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 349271
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2.bp.blogspot.com/-kn981BkQVJU/YI6bqIrxJ5I/AAAAAAAAZQQ/GHZapFWHa2M40onyEGhbVyKMprb9xA06gCK4BGAYYCw/s1600/FOLLOW-BC.png
200 OK 7.4 kB URL GET HTTP/2 2.bp.blogspot.com/-kn981BkQVJU/YI6bqIrxJ5I/AAAAAAAAZQQ/GHZapFWHa2M40onyEGhbVyKMprb9xA06gCK4BGAYYCw/s1600/FOLLOW-BC.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type PNG image data, 176 x 68, 8-bit/color RGB, non-interlaced\012- data
Hash 18a5f2ec5b29f0574b87b5f5f6820e91
44be68677f6c64cfddca3446230e73d82cad969f
8ead09b519555de565f0d8de6b8826acabd5bd4f1afea6ac02242d4248efe2e7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /-kn981BkQVJU/YI6bqIrxJ5I/AAAAAAAAZQQ/GHZapFWHa2M40onyEGhbVyKMprb9xA06gCK4BGAYYCw/s1600/FOLLOW-BC.png HTTP/1.1
Host: 2.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="FOLLOW-BC.png"
x-content-type-options: nosniff
server: fife
content-length: 7437
x-xss-protection: 0
date: Sat, 23 Sep 2023 16:24:02 GMT
expires: Sun, 24 Sep 2023 16:24:02 GMT
cache-control: public, max-age=86400, no-transform
age: 15
etag: "v6505"
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
1.bp.blogspot.com/-urSmSI2padc/V7wlOspiFZI/AAAAAAAABM8/jOQFoNZWTX4Nsf6DtRchBRsfrvgXOxGqwCLcB/s1600/address2.png
200 OK 12 kB URL GET HTTP/2 1.bp.blogspot.com/-urSmSI2padc/V7wlOspiFZI/AAAAAAAABM8/jOQFoNZWTX4Nsf6DtRchBRsfrvgXOxGqwCLcB/s1600/address2.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type PNG image data, 100 x 60, 8-bit/color RGBA, non-interlaced\012- data
Hash 22abf14b39bf8796629c42a44e2f295e
ee7c8c859577bb755d81ea5c9c99a13f94cc5cac
446b0f4c3ddb942545af14581eac760b248a61f7ab31f70de256f3ef68c8f074
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /-urSmSI2padc/V7wlOspiFZI/AAAAAAAABM8/jOQFoNZWTX4Nsf6DtRchBRsfrvgXOxGqwCLcB/s1600/address2.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="address2.png"
x-content-type-options: nosniff
server: fife
content-length: 12033
x-xss-protection: 0
date: Sat, 23 Sep 2023 16:24:02 GMT
expires: Sun, 24 Sep 2023 16:24:02 GMT
cache-control: public, max-age=86400, no-transform
age: 15
etag: "v4d2"
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 5deab2863cc64ff54664df9e40738c24
7e731c4f0a6c9cbc80490586ddb39a82dcfbb5ae
fc49292164496bd63fb16adb3f5b6fc10d0c5f397c19007a858848257ea4a302
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
1.bp.blogspot.com/-dKH21b0Rez8/V7wlH7UufMI/AAAAAAAABM4/9dz-mLgRy4sAnOJVa-qLHY7MMMJDzoNUQCLcB/s1600/big-thanks2.png
200 OK 17 kB URL GET HTTP/2 1.bp.blogspot.com/-dKH21b0Rez8/V7wlH7UufMI/AAAAAAAABM4/9dz-mLgRy4sAnOJVa-qLHY7MMMJDzoNUQCLcB/s1600/big-thanks2.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced\012- data
Hash 6db0f6efe4695f4937c6ec581525b5ab
1c1196d1d8b788dc090ee21677f84dfe74732ae6
27b8c90e2bba543cc5fd79104da6e08d0e670db09e443a3643df64c843b3c1f4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /-dKH21b0Rez8/V7wlH7UufMI/AAAAAAAABM4/9dz-mLgRy4sAnOJVa-qLHY7MMMJDzoNUQCLcB/s1600/big-thanks2.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="big-thanks2.png"
x-content-type-options: nosniff
server: fife
content-length: 17412
x-xss-protection: 0
date: Sat, 23 Sep 2023 16:24:02 GMT
expires: Sun, 24 Sep 2023 16:24:02 GMT
cache-control: public, max-age=86400, no-transform
etag: "v4d0"
content-type: image/png
vary: Origin
age: 15
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
2.bp.blogspot.com/-h0YLcA9BtVE/YI6add-I_qI/AAAAAAAAZQE/TT2IgIC1Xxgo6lcOzOuofs8Jl61gSrqvACK4BGAYYCw/s482/twitter-2.png
200 OK 9.4 kB URL GET HTTP/2 2.bp.blogspot.com/-h0YLcA9BtVE/YI6add-I_qI/AAAAAAAAZQE/TT2IgIC1Xxgo6lcOzOuofs8Jl61gSrqvACK4BGAYYCw/s482/twitter-2.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type PNG image data, 176 x 68, 8-bit/color RGBA, non-interlaced\012- data
Hash 7e70b98cf6bb7dd0304e8039136c40cc
a50829b9a331c20d640e670493e4488d93015575
16ce2aceb0e0cf0a3725ceb81832cd83bb0a1c4d52225b9e9a71940ec3b47f98
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /-h0YLcA9BtVE/YI6add-I_qI/AAAAAAAAZQE/TT2IgIC1Xxgo6lcOzOuofs8Jl61gSrqvACK4BGAYYCw/s482/twitter-2.png HTTP/1.1
Host: 2.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="twitter-2.png"
x-content-type-options: nosniff
server: fife
content-length: 9371
x-xss-protection: 0
date: Sat, 23 Sep 2023 16:24:02 GMT
expires: Sun, 24 Sep 2023 16:24:02 GMT
cache-control: public, max-age=86400, no-transform
age: 15
etag: "v6502"
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
472 B IP
Hash 128fe2f55863135d7197a64373812d46
110a159115c90116bf86ddd99b83f643c0c0e854
e46b38e8f0a1defddd4f3bdb976cad1ff91ef32422673cae824dd0b10df28ea6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 94111c3420bb2c6a13c84437834119c2
a60b1aaa235c754b4f840e14e5c32f3bd1920d3b
9f0636387ba07be147b51285a1e30b77ad2e4e77126f1c1082775fd981b32d78
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 8fe5097b12ddbaa7731f5c6d445db349
b1d9718a7e3ead4ad6c08b3c888129ddf9ba52af
3133a3d91f11eeb170b6a3149b7cceb04228b72a222187bcc374f1fbbdbf4bd3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css
200 OK 7.8 kB URL GET HTTP/2 www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type ASCII text, with very long lines (35959)
Hash 1e32420a7b6ddbdcb7def8b3141c4d1e
a1be54d42ff1f95244c9653539f90318f5bc0580
a9ca837900b6ae007386d400f659c233120b8af7d93407fd6475c9180d9e83d2
GET /static/v1/widgets/3566091532-css_bundle_v2.css HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 7756
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 18 Sep 2023 20:27:35 GMT
expires: Tue, 17 Sep 2024 20:27:35 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 18 Sep 2023 14:53:49 GMT
content-type: text/css
vary: Accept-Encoding
age: 417402
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 5deab2863cc64ff54664df9e40738c24
7e731c4f0a6c9cbc80490586ddb39a82dcfbb5ae
fc49292164496bd63fb16adb3f5b6fc10d0c5f397c19007a858848257ea4a302
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
resources.blogblog.com/img/icon18_edit_allbkg.gif
200 OK 162 B URL GET HTTP/2 resources.blogblog.com/img/icon18_edit_allbkg.gif
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type GIF image data, version 89a, 18 x 18\012- data
Hash c991641178ff05adf0d004298b5eafa9
d8f6ce8ecd92b86d49849360f6b81ceb10b4c941
ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b
GET /img/icon18_edit_allbkg.gif HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 162
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:51:49 GMT
expires: Sat, 30 Sep 2023 13:51:49 GMT
cache-control: public, max-age=604800
last-modified: Sat, 23 Sep 2023 06:53:52 GMT
content-type: image/gif
age: 9148
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
472 B IP
Hash 8e0560c46747530b07f20c3704aecf0c
30e8a5e5b62c28ed29ef6408f9044f2d8a911db5
e5b8c6bd88bfb832b0b14cf3e17048b546cbf82d7de8d539f8fdad12794b3cb8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js
200 OK 27 kB URL GET HTTP/2 ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.min.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintBE:40:3A:A6:DE:CC:A7:8B:75:43:68:F2:F9:56:63:71:49:61:06:49
ValidityMon, 04 Sep 2023 08:23:18 GMT - Mon, 27 Nov 2023 08:23:17 GMT
File type ASCII text, with very long lines (820)
Hash 73a9c334c5ca71d70d092b42064f6476
b75990598ee8d3895448ed9d08726af63109f842
517364f2d45162fb5037437b5b6cb953d00d9b2b3b79ba87d9fe57ea6ee6070c
GET /ajax/libs/jquery/1.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 27266
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 22 Sep 2023 18:35:50 GMT
expires: Sat, 21 Sep 2024 18:35:50 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 78507
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
apis.google.com/js/platform.js
200 OK 22 kB URL GET HTTP/3 apis.google.com/js/platform.js
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (2664)
Hash ce7e88034e2b1226294f3d7e515299c9
326b37908964a9f69460d42cb646716c9f1e86e1
08280e7af6518c3230f34d50cb9534b35c82fddd96138896e2608d9a12661bbe
GET /js/platform.js HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 21949
date: Sat, 23 Sep 2023 16:24:17 GMT
expires: Sat, 23 Sep 2023 16:24:17 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "22f179323a7dd95a"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=UA-81232046-1
200 OK 69 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=UA-81232046-1
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint00:ED:16:68:8D:DB:14:8B:43:01:81:CA:83:9A:AE:5B:24:AB:11:18
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (4179)
Hash a323cdf6b955180c9ac8e3237f08d186
4ebfa6894b9a29498df6cb02245f71fd961c22ef
0a6d6ee79276c1c96c8d83a8ad69d2c22d6d7f13e36a16ca7ee8faeba1e1a5b0
GET /gtag/js?id=UA-81232046-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 23 Sep 2023 16:24:17 GMT
expires: Sat, 23 Sep 2023 16:24:17 GMT
cache-control: private, max-age=900
last-modified: Sat, 23 Sep 2023 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 69023
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.blogger.com/static/v1/widgets/562952797-widgets.js
200 OK 160 kB URL GET HTTP/2 www.blogger.com/static/v1/widgets/562952797-widgets.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type ASCII text, with very long lines (2215)
Size 160 kB (160393 bytes)
Hash 0804e4c7fd72aea2ce34a04d9ec9686c
9f46bef1076230a1271d151a506fd1d91ae7df93
5ea4b0b19c5f030a3b42b570c07cbea89a7899f1d824a95b53ad2c4ca18a2b5c
GET /static/v1/widgets/562952797-widgets.js HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 160393
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 20 Sep 2023 02:21:50 GMT
expires: Thu, 19 Sep 2024 02:21:50 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 20 Sep 2023 00:55:53 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 309747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 04c3317215dbb6290c22b51fb76ba3fd
4f6dd945ef1d6d3ff6863608e7f26b1ba0b00134
47ca7e2430599f81f776f12dfad83f9a89ac22c636adfdfbb7b001e3b9167c16
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 04c3317215dbb6290c22b51fb76ba3fd
4f6dd945ef1d6d3ff6863608e7f26b1ba0b00134
47ca7e2430599f81f776f12dfad83f9a89ac22c636adfdfbb7b001e3b9167c16
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
3.bp.blogspot.com/-nqHaCWKFEug/WM7SRFvU10I/AAAAAAAAEVI/QyrW9BWxtpAKUqja1BY5MCIzYSW_vgZ3ACLcB/s320/lock-ransom.jpg
200 OK 24 kB URL GET HTTP/2 3.bp.blogspot.com/-nqHaCWKFEug/WM7SRFvU10I/AAAAAAAAEVI/QyrW9BWxtpAKUqja1BY5MCIzYSW_vgZ3ACLcB/s320/lock-ransom.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x235, components 3\012- data
Hash f61f01125552515993a92f4e7fec0756
707285f2e41a37531a1349134d210b7535f01767
c7a7e28b08ba281b533785fc02855adac37c69e0416c9da466c737b1cbb2c3df
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /-nqHaCWKFEug/WM7SRFvU10I/AAAAAAAAEVI/QyrW9BWxtpAKUqja1BY5MCIzYSW_vgZ3ACLcB/s320/lock-ransom.jpg HTTP/1.1
Host: 3.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
etag: "v1153"
expires: Sun, 24 Sep 2023 16:24:17 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="lock-ransom.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:17 GMT
server: fife
content-length: 24033
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 04c3317215dbb6290c22b51fb76ba3fd
4f6dd945ef1d6d3ff6863608e7f26b1ba0b00134
47ca7e2430599f81f776f12dfad83f9a89ac22c636adfdfbb7b001e3b9167c16
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 5deab2863cc64ff54664df9e40738c24
7e731c4f0a6c9cbc80490586ddb39a82dcfbb5ae
fc49292164496bd63fb16adb3f5b6fc10d0c5f397c19007a858848257ea4a302
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 04c3317215dbb6290c22b51fb76ba3fd
4f6dd945ef1d6d3ff6863608e7f26b1ba0b00134
47ca7e2430599f81f776f12dfad83f9a89ac22c636adfdfbb7b001e3b9167c16
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash a5f5467555eddaec1c42dc5e77af601a
47c172dac1e914c8962b8ad8684ef16ad8742ce2
2e1982a8d405cc85b00953f293a893a61dc1d08977d3cef226054c33ba3c3f1a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 8fe5097b12ddbaa7731f5c6d445db349
b1d9718a7e3ead4ad6c08b3c888129ddf9ba52af
3133a3d91f11eeb170b6a3149b7cceb04228b72a222187bcc374f1fbbdbf4bd3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
472 B IP
Hash 8e0560c46747530b07f20c3704aecf0c
30e8a5e5b62c28ed29ef6408f9044f2d8a911db5
e5b8c6bd88bfb832b0b14cf3e17048b546cbf82d7de8d539f8fdad12794b3cb8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 94111c3420bb2c6a13c84437834119c2
a60b1aaa235c754b4f840e14e5c32f3bd1920d3b
9f0636387ba07be147b51285a1e30b77ad2e4e77126f1c1082775fd981b32d78
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs
200 OK 61 kB URL GET HTTP/2 apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.apis.google.com
FingerprintB1:CC:B9:00:18:09:CE:C0:F7:B1:3F:29:95:6B:4A:93:CC:9A:19:0A
ValidityMon, 04 Sep 2023 08:23:36 GMT - Mon, 27 Nov 2023 08:23:35 GMT
File type ASCII text, with very long lines (1503)
Hash 76cf20f34e61bb4ebd83ecf652268483
ff6c80fb175d247f11cceb99b7eb113f043c703b
34ed5573773da6701a325bf1c4ee50adbacab764a71e26efe12843e38bd7d438
GET /_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 60820
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 18 Sep 2023 17:31:08 GMT
expires: Tue, 17 Sep 2024 17:31:08 GMT
cache-control: public, max-age=31536000
last-modified: Sat, 02 Sep 2023 15:18:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 427989
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.blogger.com/img/share_buttons_20_3.png
200 OK 5.1 kB URL GET HTTP/3 www.blogger.com/img/share_buttons_20_3.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type PNG image data, 120 x 60, 8-bit/color RGBA, non-interlaced\012- data
Hash ad9999106d5f550920b586e8e1704e5a
93fd02c51166402a41f96509cd0ca3fb917877dd
3829a5b2ade7cfc416c80b8f3df71e49e68672875f025d525223978f5cee3fd3
GET /img/share_buttons_20_3.png HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 5080
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Sep 2023 02:56:33 GMT
expires: Tue, 26 Sep 2023 02:56:33 GMT
cache-control: public, max-age=604800
last-modified: Mon, 18 Sep 2023 12:52:31 GMT
content-type: image/png
age: 394064
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogblog.com/1kt/ethereal/white-fade.png
200 OK 144 B URL GET HTTP/3 www.blogblog.com/1kt/ethereal/white-fade.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type PNG image data, 1 x 590, 8-bit/color RGBA, non-interlaced\012- data
Hash 4ba06844286b94adfc8ad7bc8a8fde94
9e1fa0c37abf7c05300b90f8938dd2458409a35e
909a47a95386ffd0420ff44c0f1278a3259b918b1bc8213afa97ad6a4bb5bb58
GET /1kt/ethereal/white-fade.png HTTP/1.1
Host: www.blogblog.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 144
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 18 Sep 2023 22:04:50 GMT
expires: Mon, 25 Sep 2023 22:04:50 GMT
cache-control: public, max-age=604800
last-modified: Mon, 18 Sep 2023 20:58:54 GMT
content-type: image/png
age: 411567
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2.bp.blogspot.com/-UQOCaF5IV3k/WharCXygFVI/AAAAAAAAIG8/nAFDPR77cNoka_ZNUFKnQb_y4l9UMdU0gCK4BGAYYCw/s0/00001.jpg
200 OK 153 kB URL GET HTTP/3 2.bp.blogspot.com/-UQOCaF5IV3k/WharCXygFVI/AAAAAAAAIG8/nAFDPR77cNoka_ZNUFKnQb_y4l9UMdU0gCK4BGAYYCw/s0/00001.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=3, software=Google], baseline, precision 8, 1200x750, components 3\012- data
Size 153 kB (152886 bytes)
Hash cfc8688e8aaf87b89967985f5f812472
53091691541815b7308b2690d9003eb9b1c4adb6
580c3cc5729f226bbee2626a16e7882b8d4dd1bb75b116ba1f2b44d40a4766a0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /-UQOCaF5IV3k/WharCXygFVI/AAAAAAAAIG8/nAFDPR77cNoka_ZNUFKnQb_y4l9UMdU0gCK4BGAYYCw/s0/00001.jpg HTTP/1.1
Host: 2.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="00001.jpg"
x-content-type-options: nosniff
server: fife
content-length: 152886
x-xss-protection: 0
date: Sat, 23 Sep 2023 16:24:04 GMT
expires: Sun, 24 Sep 2023 16:24:04 GMT
cache-control: public, max-age=86400, no-transform
age: 13
etag: "v2070"
content-type: image/jpeg
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
apis.google.com/js/platform.js
200 OK 22 kB URL GET HTTP/3 apis.google.com/js/platform.js
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (2664)
Hash ce7e88034e2b1226294f3d7e515299c9
326b37908964a9f69460d42cb646716c9f1e86e1
08280e7af6518c3230f34d50cb9534b35c82fddd96138896e2608d9a12661bbe
GET /js/platform.js HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 21949
date: Sat, 23 Sep 2023 16:24:17 GMT
expires: Sat, 23 Sep 2023 16:24:17 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "22f179323a7dd95a"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/a/AVvXsEhz68l0QU2WHXEb4Bv7j1Id910nuiGhJZ88hcjdt1h5ET2m-u4yqrNmVHbd4_go8WVrjQ9Ottumbn4YB0FjByZEidjSAo69MPEjmfoOcdBeW7k6UsfynUzL2_JHOdBwOKXSyKEffAgL2xzZLcBrTQNGpu_h8JRd_Z84UTEmE0Araw_OKEE4v1mC6oy7=s369
200 OK 29 kB URL GET HTTP/2 blogger.googleusercontent.com/img/a/AVvXsEhz68l0QU2WHXEb4Bv7j1Id910nuiGhJZ88hcjdt1h5ET2m-u4yqrNmVHbd4_go8WVrjQ9Ottumbn4YB0FjByZEidjSAo69MPEjmfoOcdBeW7k6UsfynUzL2_JHOdBwOKXSyKEffAgL2xzZLcBrTQNGpu_h8JRd_Z84UTEmE0Araw_OKEE4v1mC6oy7=s369
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 262x369, components 3\012- data
Hash 8ad5787729ba974380bc1fd91e9a63b3
491e458a95742776d280e6c83b396c109a0970d9
e59717f22bd5b4b6ed44315254f259fdcf81c721eb221b928ca6c1a494159d33
GET /img/a/AVvXsEhz68l0QU2WHXEb4Bv7j1Id910nuiGhJZ88hcjdt1h5ET2m-u4yqrNmVHbd4_go8WVrjQ9Ottumbn4YB0FjByZEidjSAo69MPEjmfoOcdBeW7k6UsfynUzL2_JHOdBwOKXSyKEffAgL2xzZLcBrTQNGpu_h8JRd_Z84UTEmE0Araw_OKEE4v1mC6oy7=s369 HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v7458"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="of2019.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 29128
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-99EZ5NYFNR&l=dataLayer&cx=c
200 OK 80 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=G-99EZ5NYFNR&l=dataLayer&cx=c
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint00:ED:16:68:8D:DB:14:8B:43:01:81:CA:83:9A:AE:5B:24:AB:11:18
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (4179)
Hash 10cdd7592b0e3655a527c920edd6590a
6513c68308cca5d69734123e35688cb7658974f3
f419d5928011cfc0a32627681a2b5d58af7ae9ed8f869ec1093f627e1a7a8712
GET /gtag/js?id=G-99EZ5NYFNR&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 23 Sep 2023 16:24:18 GMT
expires: Sat, 23 Sep 2023 16:24:18 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 79651
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRwXdwsRmTaZgzp4OM5POmpzCFcTfwSPBbw5q6OV7b7bHvFrUH1fkcFAj2m71z3D03V271XXaExHM7meytuSTC6y-Sn8Ynspfgt6mLl2pGvDx82qCBJm8UuI9-JYhP2C7_ensgyhQAnryxgjeVPvBBs7jPg1J-uGq2X9lJKn2VyWPtvZqkNWXhcAJXXRU/w72-h72-p-k-no-nu/logo.jpg
200 OK 4.2 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRwXdwsRmTaZgzp4OM5POmpzCFcTfwSPBbw5q6OV7b7bHvFrUH1fkcFAj2m71z3D03V271XXaExHM7meytuSTC6y-Sn8Ynspfgt6mLl2pGvDx82qCBJm8UuI9-JYhP2C7_ensgyhQAnryxgjeVPvBBs7jPg1J-uGq2X9lJKn2VyWPtvZqkNWXhcAJXXRU/w72-h72-p-k-no-nu/logo.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 72x72, components 3\012- data
Hash c9e7f4ffd403293b6a8ebdadf1aee0b5
060687e72459fc39643dfb92a13c158d7d80aadd
f027f2291e3124e9cdc8170b86f6b47a70f2fddba02cf72ebe92402268a06327
GET /img/b/R29vZ2xl/AVvXsEjRwXdwsRmTaZgzp4OM5POmpzCFcTfwSPBbw5q6OV7b7bHvFrUH1fkcFAj2m71z3D03V271XXaExHM7meytuSTC6y-Sn8Ynspfgt6mLl2pGvDx82qCBJm8UuI9-JYhP2C7_ensgyhQAnryxgjeVPvBBs7jPg1J-uGq2X9lJKn2VyWPtvZqkNWXhcAJXXRU/w72-h72-p-k-no-nu/logo.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v7903"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 4205
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMgepvsMVN_Y0uY0WwPaQ6SlP3SNofyx-NRPJ9Em_2HV3S14sCAATHPwOn4_P1zCn7a9ob8Sel68LhLu66MDtLkIsxC5Waxyxni2p9p6Ky7l1JmcB_eRTrUQLF6enRxdcFZl_jMGeyDiQBzflOm4I_CKbbvdgo98q78j1jBGXu-a2hfmeAIM5okgtO6b8/w72-h72-p-k-no-nu/logo.png
200 OK 6.6 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMgepvsMVN_Y0uY0WwPaQ6SlP3SNofyx-NRPJ9Em_2HV3S14sCAATHPwOn4_P1zCn7a9ob8Sel68LhLu66MDtLkIsxC5Waxyxni2p9p6Ky7l1JmcB_eRTrUQLF6enRxdcFZl_jMGeyDiQBzflOm4I_CKbbvdgo98q78j1jBGXu-a2hfmeAIM5okgtO6b8/w72-h72-p-k-no-nu/logo.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 72 x 72, 8-bit/color RGB, non-interlaced\012- data
Hash a0c8ffe16cca6767c8e2068ec5f60a18
cf100dcf50fd00a8d45aa8861f6773459470732a
4e8f4cbfb0b071fbfe286aae1c966429d1e7fcc19ba3bc69056d03d16230206e
GET /img/b/R29vZ2xl/AVvXsEhMgepvsMVN_Y0uY0WwPaQ6SlP3SNofyx-NRPJ9Em_2HV3S14sCAATHPwOn4_P1zCn7a9ob8Sel68LhLu66MDtLkIsxC5Waxyxni2p9p6Ky7l1JmcB_eRTrUQLF6enRxdcFZl_jMGeyDiQBzflOm4I_CKbbvdgo98q78j1jBGXu-a2hfmeAIM5okgtO6b8/w72-h72-p-k-no-nu/logo.png HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
vary: Origin
access-control-expose-headers: Content-Length
etag: "v7847"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.png"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 6599
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/a/AVvXsEgM1txPrE0dnVk8xuu14FlSE0PJNcycYw0xw8NG_mzcoz_1tUnqX4mhWLTNfpF5-DYf9qynWFerCqDyIf7tJN1FELjFXf3-gSzegOCjv2Xmai0S9B28GUqUYwdvrnZUKQRUaz09LZSBhOpOpFxTCbBXtkT-XERwieDARTbGoUKnbdKed6ZaaKN_LaeJ=s262
200 OK 214 kB URL GET HTTP/2 blogger.googleusercontent.com/img/a/AVvXsEgM1txPrE0dnVk8xuu14FlSE0PJNcycYw0xw8NG_mzcoz_1tUnqX4mhWLTNfpF5-DYf9qynWFerCqDyIf7tJN1FELjFXf3-gSzegOCjv2Xmai0S9B28GUqUYwdvrnZUKQRUaz09LZSBhOpOpFxTCbBXtkT-XERwieDARTbGoUKnbdKed6ZaaKN_LaeJ=s262
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type GIF image data, version 89a, 262 x 262\012- data
Size 214 kB (214194 bytes)
Hash e113ba639e6cef07bb3b7145478356a9
95549596a021e6b3e9ba8f7bd991af146d15cb91
2e2f6993e2d20eb510a48b5ce8d2f7c2e9cf93d0f731685e1c77a9b289b4332b
GET /img/a/AVvXsEgM1txPrE0dnVk8xuu14FlSE0PJNcycYw0xw8NG_mzcoz_1tUnqX4mhWLTNfpF5-DYf9qynWFerCqDyIf7tJN1FELjFXf3-gSzegOCjv2Xmai0S9B28GUqUYwdvrnZUKQRUaz09LZSBhOpOpFxTCbBXtkT-XERwieDARTbGoUKnbdKed6ZaaKN_LaeJ=s262 HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/gif
vary: Origin
access-control-expose-headers: Content-Length
etag: "v769f"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="mailservice.gif"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 214194
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCLMqd8fgX6ulF0fuAf_a58zslaDGBxqDTXXH6F2HR54-S9WCxD8qeGPk5N6dUD4aTM-BtkvxJY7UW_B7y2TB5Dsl8NRQOfczJtCdPl7X8D0aIk7ybut7g8TEKAcBPOT5kcE2fIQDg5iGYiW3vhMh7to7Pm4r-VUn7cMNZbz_ZfuNHTF638hUUevnG/w72-h72-p-k-no-nu/logo.jpg
200 OK 3.1 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCLMqd8fgX6ulF0fuAf_a58zslaDGBxqDTXXH6F2HR54-S9WCxD8qeGPk5N6dUD4aTM-BtkvxJY7UW_B7y2TB5Dsl8NRQOfczJtCdPl7X8D0aIk7ybut7g8TEKAcBPOT5kcE2fIQDg5iGYiW3vhMh7to7Pm4r-VUn7cMNZbz_ZfuNHTF638hUUevnG/w72-h72-p-k-no-nu/logo.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 72x72, components 3\012- data
Hash 6ad3b1b559429670bbf1c1827163814f
a9d70b4f10a84d3ab8e36e7836e487baed1eb839
8c204971ea49b8c03d97520ff2b5dc8f179b563968d63dd5e4189bb92e4989dd
GET /img/b/R29vZ2xl/AVvXsEiCLMqd8fgX6ulF0fuAf_a58zslaDGBxqDTXXH6F2HR54-S9WCxD8qeGPk5N6dUD4aTM-BtkvxJY7UW_B7y2TB5Dsl8NRQOfczJtCdPl7X8D0aIk7ybut7g8TEKAcBPOT5kcE2fIQDg5iGYiW3vhMh7to7Pm4r-VUn7cMNZbz_ZfuNHTF638hUUevnG/w72-h72-p-k-no-nu/logo.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v7816"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 3133
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgn9IhitPz8IMfU77JWQ26cntBfC8sw8_fyOzLD4BxEUpPImfJ_Y7heKnXxBqfSYq-OmTYCLwIOGpZd29t-4W00oTVx1ZA-g3YRXLjRBk-LLN2olatOdhh6_Arwek-ZIm61s9Q_suLdCybDJh_mUTA_ULenYJ3jLWlbszMvRdkyAHw-vU-NwJpUkgxE/w72-h72-p-k-no-nu/logo.png
200 OK 3.5 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgn9IhitPz8IMfU77JWQ26cntBfC8sw8_fyOzLD4BxEUpPImfJ_Y7heKnXxBqfSYq-OmTYCLwIOGpZd29t-4W00oTVx1ZA-g3YRXLjRBk-LLN2olatOdhh6_Arwek-ZIm61s9Q_suLdCybDJh_mUTA_ULenYJ3jLWlbszMvRdkyAHw-vU-NwJpUkgxE/w72-h72-p-k-no-nu/logo.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 72 x 72, 8-bit/color RGB, non-interlaced\012- data
Hash 4bb5ac0f5afcf146d9da3a3531f7feb7
36c25c79cb0b7e746cd893309db3e4153e426183
fc7d64b4f92f224d34a8545b1e2cb750e93c9cddd1fdb8fcfeb4f0f14966ab70
GET /img/b/R29vZ2xl/AVvXsEgn9IhitPz8IMfU77JWQ26cntBfC8sw8_fyOzLD4BxEUpPImfJ_Y7heKnXxBqfSYq-OmTYCLwIOGpZd29t-4W00oTVx1ZA-g3YRXLjRBk-LLN2olatOdhh6_Arwek-ZIm61s9Q_suLdCybDJh_mUTA_ULenYJ3jLWlbszMvRdkyAHw-vU-NwJpUkgxE/w72-h72-p-k-no-nu/logo.png HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
vary: Origin
access-control-expose-headers: Content-Length
etag: "v77c7"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.png"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 3493
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjz8gSGDGYBRICMP6VJSXGOBzyw-1l5s9lgI1kzEJd-BGvR5JNqTK3bEULaygh7STt_ZDM4-pDrASmBQ2AcSIjJQjWLJZrZcB6AljqwMVHoU5qLNiWbKwSiF9jeUF9lipKXOqu0Ht4SHHQ8_KpBbQi34C3CAgjjklVNclyG7pCOB4KIa7imXcPFFso8RWk/w72-h72-p-k-no-nu/logo.jpg
200 OK 4.7 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjz8gSGDGYBRICMP6VJSXGOBzyw-1l5s9lgI1kzEJd-BGvR5JNqTK3bEULaygh7STt_ZDM4-pDrASmBQ2AcSIjJQjWLJZrZcB6AljqwMVHoU5qLNiWbKwSiF9jeUF9lipKXOqu0Ht4SHHQ8_KpBbQi34C3CAgjjklVNclyG7pCOB4KIa7imXcPFFso8RWk/w72-h72-p-k-no-nu/logo.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 72x72, components 3\012- data
Hash fe5d088699dac223fe92b3bac28277ff
80e01f58613c2b764a8d1792710997f54bdfbdfe
f1dac5c58f2871c51c1aa041cd3046a05dccb6f2fe2bb7ad297578151e74054b
GET /img/b/R29vZ2xl/AVvXsEjz8gSGDGYBRICMP6VJSXGOBzyw-1l5s9lgI1kzEJd-BGvR5JNqTK3bEULaygh7STt_ZDM4-pDrASmBQ2AcSIjJQjWLJZrZcB6AljqwMVHoU5qLNiWbKwSiF9jeUF9lipKXOqu0Ht4SHHQ8_KpBbQi34C3CAgjjklVNclyG7pCOB4KIa7imXcPFFso8RWk/w72-h72-p-k-no-nu/logo.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v78bc"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 4732
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9EfVziuHLpdi4CHIOTYcfaoEaxQ2yd1tGZj2eBJGmoGLbMX33qTJeIRkW7Kyof-25KCBb7ip0YWh59iUso3pJryuzF6BaM0iY_O-VxYrgRsCkByIq11Me0DUH0vIwmd0_v_8ZMnKEU6Mt__soIxIfjapKhFIF0HvTBgr5ir_uPDx7DZ45ubr2EhLJKMM/w72-h72-p-k-no-nu/logo.jpg
200 OK 4.2 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9EfVziuHLpdi4CHIOTYcfaoEaxQ2yd1tGZj2eBJGmoGLbMX33qTJeIRkW7Kyof-25KCBb7ip0YWh59iUso3pJryuzF6BaM0iY_O-VxYrgRsCkByIq11Me0DUH0vIwmd0_v_8ZMnKEU6Mt__soIxIfjapKhFIF0HvTBgr5ir_uPDx7DZ45ubr2EhLJKMM/w72-h72-p-k-no-nu/logo.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 72x72, components 3\012- data
Hash 77fbd132166e7c5ebd64f84cd029a4d5
7d7f64481dcf2f37f7a527faee84fdf488035b89
796b09c75a24e00f4ebf625e80c419dd3196cb0fd859476f3647d584afc5887e
GET /img/b/R29vZ2xl/AVvXsEg9EfVziuHLpdi4CHIOTYcfaoEaxQ2yd1tGZj2eBJGmoGLbMX33qTJeIRkW7Kyof-25KCBb7ip0YWh59iUso3pJryuzF6BaM0iY_O-VxYrgRsCkByIq11Me0DUH0vIwmd0_v_8ZMnKEU6Mt__soIxIfjapKhFIF0HvTBgr5ir_uPDx7DZ45ubr2EhLJKMM/w72-h72-p-k-no-nu/logo.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v78b2"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 4169
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
472 B IP
Hash 126b0a9f06e2940180b9f3d7bf846ee3
837d11e1daeabaeb84b17ab34e3668d5f654f5bd
0f4e2ec6b04e2bbfec447077213cb23fe5008094a636f4de026a9534a0edb691
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:18 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFPH0SV_6z2VW3_mb_yFlkvyKyiI0_yMqSHGpsGbFX4rOSm1UvAmZzFYvvdpQpxtMW9hjJqj9iADczL4-ZZpbr8pXHI0B58kT7cz0XkXTYCV_auUj_xTrhiXWc5BBT74oXTAU9dAs40MkPn8qwBPmLQb-p-oE1AUPy6YlSyc6qDHBRb9zzYEg6-V5qhGU/w72-h72-p-k-no-nu/logo.jpg
200 OK 5.0 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFPH0SV_6z2VW3_mb_yFlkvyKyiI0_yMqSHGpsGbFX4rOSm1UvAmZzFYvvdpQpxtMW9hjJqj9iADczL4-ZZpbr8pXHI0B58kT7cz0XkXTYCV_auUj_xTrhiXWc5BBT74oXTAU9dAs40MkPn8qwBPmLQb-p-oE1AUPy6YlSyc6qDHBRb9zzYEg6-V5qhGU/w72-h72-p-k-no-nu/logo.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 72x72, components 3\012- data
Hash 15c27e4fc464c7925cead955bb94196e
26f297eb5498c039739dc2ba374bb0b58aabf20d
f9c1e80514456f65b8606fb80771b3491fbd70e450f5d69fcc7a173ed958432e
GET /img/b/R29vZ2xl/AVvXsEgFPH0SV_6z2VW3_mb_yFlkvyKyiI0_yMqSHGpsGbFX4rOSm1UvAmZzFYvvdpQpxtMW9hjJqj9iADczL4-ZZpbr8pXHI0B58kT7cz0XkXTYCV_auUj_xTrhiXWc5BBT74oXTAU9dAs40MkPn8qwBPmLQb-p-oE1AUPy6YlSyc6qDHBRb9zzYEg6-V5qhGU/w72-h72-p-k-no-nu/logo.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v789a"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 5043
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3wXrRKhk0fn15HM47ULYRfiwcaB37j59XD-uWrGp8MgBvOz44BccjhFpMzzyrHOy3oDcwHbJjRGpMGdbk4rdOY7DPWBlDuYOuGD_nDTtvw3UBkUARzpx6XVOJ02gQHuMmDPGAQkITnw05qJd2N6ECvP615NLGw1118qDXb72IK_dH-OLQEzQLHGKU7c8/w72-h72-p-k-no-nu/logo1.png
200 OK 6.9 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3wXrRKhk0fn15HM47ULYRfiwcaB37j59XD-uWrGp8MgBvOz44BccjhFpMzzyrHOy3oDcwHbJjRGpMGdbk4rdOY7DPWBlDuYOuGD_nDTtvw3UBkUARzpx6XVOJ02gQHuMmDPGAQkITnw05qJd2N6ECvP615NLGw1118qDXb72IK_dH-OLQEzQLHGKU7c8/w72-h72-p-k-no-nu/logo1.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 72 x 72, 8-bit/color RGB, non-interlaced\012- data
Hash 28a6285e8846a34140b4f1143a863c45
b737b7f36cfcb7e52b36383748961888e597b9a7
a2bca4ad49debfe09c0d49f8e3a55b93a637421949c894983d8d93df59d0bd69
GET /img/b/R29vZ2xl/AVvXsEg3wXrRKhk0fn15HM47ULYRfiwcaB37j59XD-uWrGp8MgBvOz44BccjhFpMzzyrHOy3oDcwHbJjRGpMGdbk4rdOY7DPWBlDuYOuGD_nDTtvw3UBkUARzpx6XVOJ02gQHuMmDPGAQkITnw05qJd2N6ECvP615NLGw1118qDXb72IK_dH-OLQEzQLHGKU7c8/w72-h72-p-k-no-nu/logo1.png HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
vary: Origin
access-control-expose-headers: Content-Length
etag: "v782f"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo1.png"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 6942
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/a/AVvXsEiiD1OqhTxPtALufNuubZ1q-k7QksD3Cys48vU8lJyVP_y7eGKS0kEvfnRjTvSlMy5dQmvX6NFtUuVK1T8IHugmtWp1N3gaHwAqsqmEwRNfvgycH4clQ2n2BH9YrVk-uzzmjEoIKsWBQwfnguWOxE3TPe9SQDNwhJYAGDLkUkRT0Tzo1S0IqHzeZnyM=s195
200 OK 12 kB URL GET HTTP/2 blogger.googleusercontent.com/img/a/AVvXsEiiD1OqhTxPtALufNuubZ1q-k7QksD3Cys48vU8lJyVP_y7eGKS0kEvfnRjTvSlMy5dQmvX6NFtUuVK1T8IHugmtWp1N3gaHwAqsqmEwRNfvgycH4clQ2n2BH9YrVk-uzzmjEoIKsWBQwfnguWOxE3TPe9SQDNwhJYAGDLkUkRT0Tzo1S0IqHzeZnyM=s195
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 195x195, components 3\012- data
Hash 5f992c16fc9d5c489e3a0dad47432b43
07b9ddd291a60ed0ccfea2c3930b1d98ff717a95
ef014ce3479410d3e2607e62ac052b32f6067603948e39ca6d392ef3544bd013
GET /img/a/AVvXsEiiD1OqhTxPtALufNuubZ1q-k7QksD3Cys48vU8lJyVP_y7eGKS0kEvfnRjTvSlMy5dQmvX6NFtUuVK1T8IHugmtWp1N3gaHwAqsqmEwRNfvgycH4clQ2n2BH9YrVk-uzzmjEoIKsWBQwfnguWOxE3TPe9SQDNwhJYAGDLkUkRT0Tzo1S0IqHzeZnyM=s195 HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v745a"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="seif_s_kodom.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 11552
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh63s_DQYs6fccmz_cxrDIz1b40NMQxlww9MrtZq_mkqvWnopI3YUYSl03UXzC0Lo1cFIV2lTQiiLo8M8WExCnJtE9mVZlQk5gsiwJUXeYz3eiIaBSSapDPcTTzskX7FmRaMARw94WPiiaC4veMigvW-eJpajQ58nx174adrXBPtO86BINyqfyh5Db-iGE/w72-h72-p-k-no-nu/logo.png
200 OK 5.1 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh63s_DQYs6fccmz_cxrDIz1b40NMQxlww9MrtZq_mkqvWnopI3YUYSl03UXzC0Lo1cFIV2lTQiiLo8M8WExCnJtE9mVZlQk5gsiwJUXeYz3eiIaBSSapDPcTTzskX7FmRaMARw94WPiiaC4veMigvW-eJpajQ58nx174adrXBPtO86BINyqfyh5Db-iGE/w72-h72-p-k-no-nu/logo.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 72 x 72, 8-bit/color RGB, non-interlaced\012- data
Hash 414f36396b80099ae1614ee8a66c5a6b
a94e711ec2ac83c805bac0d3f75a4587d3609cd1
7ef366bafbbb826be12a239a24d08e4c6ccbba8b4fbac0083fa04d16abc3bd1d
GET /img/b/R29vZ2xl/AVvXsEh63s_DQYs6fccmz_cxrDIz1b40NMQxlww9MrtZq_mkqvWnopI3YUYSl03UXzC0Lo1cFIV2lTQiiLo8M8WExCnJtE9mVZlQk5gsiwJUXeYz3eiIaBSSapDPcTTzskX7FmRaMARw94WPiiaC4veMigvW-eJpajQ58nx174adrXBPtO86BINyqfyh5Db-iGE/w72-h72-p-k-no-nu/logo.png HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/png
vary: Origin
access-control-expose-headers: Content-Length
etag: "v78d2"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.png"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 5128
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJqt9YLfPmABczM_DOP0hIhLSGeAmrc74E5RfQpk0aQ-YswQIR39b8vdn4-20oLn6yPWF9lWWOj2ScQYCBtAmiTZcIj2XFjT59BTTk9xK4JOFKoQ_E-pvlQHQOCkbOp3XENVmkYCzE1W9hbA5usu53GLTf2U4aBQc_mIH1GA6JVXVx_WGrPZn3-x8jkvI/w72-h72-p-k-no-nu/logo.jpg
200 OK 2.2 kB URL GET HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJqt9YLfPmABczM_DOP0hIhLSGeAmrc74E5RfQpk0aQ-YswQIR39b8vdn4-20oLn6yPWF9lWWOj2ScQYCBtAmiTZcIj2XFjT59BTTk9xK4JOFKoQ_E-pvlQHQOCkbOp3XENVmkYCzE1W9hbA5usu53GLTf2U4aBQc_mIH1GA6JVXVx_WGrPZn3-x8jkvI/w72-h72-p-k-no-nu/logo.jpg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 72x72, components 3\012- data
Hash 40d91f0b3e099019130ea9a0d6a98d5e
2177d0747c80113d664e24aaad807b78231af708
36966132b7705512b53493d4a8cb17e284ecf031b079a3e123ff9ee9472b438c
GET /img/b/R29vZ2xl/AVvXsEjJqt9YLfPmABczM_DOP0hIhLSGeAmrc74E5RfQpk0aQ-YswQIR39b8vdn4-20oLn6yPWF9lWWOj2ScQYCBtAmiTZcIj2XFjT59BTTk9xK4JOFKoQ_E-pvlQHQOCkbOp3XENVmkYCzE1W9hbA5usu53GLTf2U4aBQc_mIH1GA6JVXVx_WGrPZn3-x8jkvI/w72-h72-p-k-no-nu/logo.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-expose-headers: Content-Length
etag: "v786d"
expires: Sun, 24 Sep 2023 16:24:18 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="logo.jpg"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:18 GMT
server: fife
content-length: 2246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.blogger.com/dyn-css/authorization.css?targetBlogID=6113896202570680354&zx=6f04e58d-981b-46a5-bf40-f51304b437d9
200 OK 21 B URL GET HTTP/3 www.blogger.com/dyn-css/authorization.css?targetBlogID=6113896202570680354&zx=6f04e58d-981b-46a5-bf40-f51304b437d9
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type very short file (no magic)
Hash 68b329da9893e34099c7d8ad5cb9c940
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
GET /dyn-css/authorization.css?targetBlogID=6113896202570680354&zx=6f04e58d-981b-46a5-bf40-f51304b437d9 HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:18 GMT
last-modified: Sat, 23 Sep 2023 16:24:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
content-length: 21
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ocsp.pki.goog/gts1c3
471 B IP
Hash 04c3317215dbb6290c22b51fb76ba3fd
4f6dd945ef1d6d3ff6863608e7f26b1ba0b00134
47ca7e2430599f81f776f12dfad83f9a89ac22c636adfdfbb7b001e3b9167c16
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:18 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
pagead2.googlesyndication.com/pagead/js/google_top_exp.js
200 OK 42 B URL GET HTTP/2 pagead2.googlesyndication.com/pagead/js/google_top_exp.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.g.doubleclick.net
Fingerprint67:E1:F2:5D:6B:29:01:55:36:48:B9:44:27:87:2A:0A:C4:DD:B7:B7
ValidityMon, 04 Sep 2023 08:17:04 GMT - Mon, 27 Nov 2023 08:17:03 GMT
Hash 7f5f2be159837d73b72a4b37616bce44
c93d7f25b530b05c26440d3352213b683d03dcc3
ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2
GET /pagead/js/google_top_exp.js HTTP/1.1
Host: pagead2.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 42
x-xss-protection: 0
date: Sat, 23 Sep 2023 10:15:49 GMT
expires: Sat, 07 Oct 2023 10:15:49 GMT
cache-control: public, max-age=1209600
age: 22109
etag: 13036835877489095579
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
472 B IP
Hash aeafca61929af48f5ce5cc58fdaaed3c
f9c7530a7c334f9199f83a568fea5392ad41c8b9
a9b7cb4305b51e6964e793e0d5fb329c39c5cb8a1f7dafcc25b0074687abe954
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
2.7 kB URL www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (3172)
Hash 35bd1c716b07cd3804f4ae4860b36afe
fd604dc57ba1881cdf149fb060c9feb1a0481aec
dbe881bd1a4cd19e09e4a97bd8075fd84e8999f4b1101b460cc2b1fec3fa7852
GET /navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__ HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 2711
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ocsp.pki.goog/gts1c3
471 B IP
Hash 2a9cb3694beef11368f7284821163a4d
32d723fad91ccd0c154e5d7e489266cfe596aa61
08cd4f8a916cab4a520c51bd519209ebe87f4898f10d1f1c968bce537c4d3916
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
546 B URL www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (1088)
Hash abec06ee8d84ac1d8428a33a3e231a0a
b7572455f495cdf2f67c1257d1d9e867dbbc6763
2d7a8aebeaba8405d751afc8bbac06d09d3c2f165bf51bd54087a1cb0a9f3bc6
GET /followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__ HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
location: https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Sat, 23 Sep 2023 16:24:19 GMT
expires: Sat, 23 Sep 2023 16:24:19 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 546
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.no.7oys_F1j_Ks.O/d=1/exm=el_conf/ed=1/rs=AN8SPfq1hgtdi168tW40ImsstAJbL5yjCA/m=el_main
200 OK 78 kB URL GET HTTP/2 translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.no.7oys_F1j_Ks.O/d=1/exm=el_conf/ed=1/rs=AN8SPfq1hgtdi168tW40ImsstAJbL5yjCA/m=el_main
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintBE:40:3A:A6:DE:CC:A7:8B:75:43:68:F2:F9:56:63:71:49:61:06:49
ValidityMon, 04 Sep 2023 08:23:18 GMT - Mon, 27 Nov 2023 08:23:17 GMT
File type ASCII text, with very long lines (1660)
Hash d6a5cd989485c06a7ecf8500cb064345
af916a6f31c3f695444cdeaf47449ff9b02c1809
07e4580c8a2e3079fe0704dcbe0163aac0c4be58208a370aaf61c968215be2cf
GET /_/translate_http/_/js/k=translate_http.tr.no.7oys_F1j_Ks.O/d=1/exm=el_conf/ed=1/rs=AN8SPfq1hgtdi168tW40ImsstAJbL5yjCA/m=el_main HTTP/1.1
Host: translate.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="rosetta"
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-length: 78269
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 21 Sep 2023 19:14:48 GMT
expires: Fri, 20 Sep 2024 19:14:48 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 20 Sep 2023 01:12:20 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 162571
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.TpYxICw8iG4.L.F4.O/d=0/rs=AN8SPfrtPftKEg7PtUwWauRCo_c976LPSg/m=el_main_css
200 OK 4.0 kB URL GET HTTP/2 www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.TpYxICw8iG4.L.F4.O/d=0/rs=AN8SPfrtPftKEg7PtUwWauRCo_c976LPSg/m=el_main_css
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type ASCII text, with very long lines (20367), with no line terminators
Hash 72d3a735ccca1027f6b3afba2c93e3a7
67f8eff8d17334c59c28fc1753bf451527c7490d
c8c845f55e2346b89894ce0df8185ee182359e096bf29987d5cf1f8a7391bef1
GET /_/translate_http/_/ss/k=translate_http.tr.TpYxICw8iG4.L.F4.O/d=0/rs=AN8SPfrtPftKEg7PtUwWauRCo_c976LPSg/m=el_main_css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="rosetta"
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-length: 3960
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 21 Sep 2023 18:36:14 GMT
expires: Fri, 20 Sep 2024 18:36:14 GMT
cache-control: public, max-age=31536000
last-modified: Sat, 15 Jul 2023 01:09:03 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
age: 164885
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash a1df14e0c62a34d1aeeb45ab94638130
d3bdfb2c75f9fdc495b9662ae128e4992accc8d6
e95646a781b21b7bebac7070f1b6e5d511fb2fa24d0b24e382ecc97736e3d92a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
id-ransomware.blogspot.com/b/stats?style=BLACK_TRANSPARENT&timeRange=ALL_TIME&token=APq4FmDjYMxFuTBW1xWXWtLbhpz0utuuyRwLVrnBXWLIgKzkZaYK5JHEtDmndfoccbzl2CRASBRtaq7tJT27AAfCZtpnA-D_jQ
200 OK 248 B URL GET HTTP/3 id-ransomware.blogspot.com/b/stats?style=BLACK_TRANSPARENT&timeRange=ALL_TIME&token=APq4FmDjYMxFuTBW1xWXWtLbhpz0utuuyRwLVrnBXWLIgKzkZaYK5JHEtDmndfoccbzl2CRASBRtaq7tJT27AAfCZtpnA-D_jQ
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type JSON data\012- , ASCII text, with very long lines (410), with no line terminators
Hash e932ba8ab5110b63b7203399b181da9e
addb392fc27d696f17d125c172531780d28c87af
dfd2fb57a029069affc3a8f5bd9acd18baf4d9aeba1301ca97cc1c6803cccf5a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /b/stats?style=BLACK_TRANSPARENT&timeRange=ALL_TIME&token=APq4FmDjYMxFuTBW1xWXWtLbhpz0utuuyRwLVrnBXWLIgKzkZaYK5JHEtDmndfoccbzl2CRASBRtaq7tJT27AAfCZtpnA-D_jQ HTTP/1.1
Host: id-ransomware.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Cookie: _ga_99EZ5NYFNR=GS1.1.1695486258.1.0.1695486258.0.0.0; _ga=GA1.1.1603073926.1695486259
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Sat, 23 Sep 2023 16:24:19 GMT
expires: Sat, 23 Sep 2023 16:24:19 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 248
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ocsp.pki.goog/gts1c3
471 B IP
Hash 2a9cb3694beef11368f7284821163a4d
32d723fad91ccd0c154e5d7e489266cfe596aa61
08cd4f8a916cab4a520c51bd519209ebe87f4898f10d1f1c968bce537c4d3916
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 23 Sep 2023 16:24:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
s05.flagcounter.com/count2/TCeO/bg_FFFFFF/txt_4D1DA1/border_F70F3D/columns_2/maxflags_50/viewers_3/labels_1/pageviews_1/flags_0/percent_1/
200 OK 37 kB URL GET HTTP/1.1 s05.flagcounter.com/count2/TCeO/bg_FFFFFF/txt_4D1DA1/border_F70F3D/columns_2/maxflags_50/viewers_3/labels_1/pageviews_1/flags_0/percent_1/
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerLet's Encrypt
Subjects02.flagcounter.com
Fingerprint0D:2C:B9:9C:7C:51:70:80:4F:83:0B:07:D9:19:4F:2D:6F:92:B9:4F
ValidityFri, 22 Sep 2023 22:29:08 GMT - Thu, 21 Dec 2023 22:29:07 GMT
File type PNG image data, 198 x 496, 8-bit/color RGB, non-interlaced\012- data
Hash 73c44908cf07249713f24cfc6e08edf6
9df6ebca48537cf560827def7df5c2de6e8be285
347e56c35814e9a1a9d58d86923ce9ac2e46b40c275ece0418fa9f9f9bddffea
GET /count2/TCeO/bg_FFFFFF/txt_4D1DA1/border_F70F3D/columns_2/maxflags_50/viewers_3/labels_1/pageviews_1/flags_0/percent_1/ HTTP/1.1
Host: s05.flagcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 23 Sep 2023 16:24:18 GMT
Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k
Pragma: no-cache
Cache-control: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: image/png
site.yandex.net/v2.0/js/all.js
200 OK 15 kB URL GET HTTP/2 site.yandex.net/v2.0/js/all.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGlobalSign nv-sa
Subject*.yastatic-net.ru
FingerprintD9:64:E0:F2:39:AC:36:DB:9A:A3:3D:E4:27:E4:0B:F5:5B:5B:E3:A0
ValidityMon, 10 Jul 2023 13:25:28 GMT - Sun, 07 Jan 2024 20:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (53862), with no line terminators
Hash 68a626d77106684c519c56a360f0facd
1c3dac43f9a7905074ff6bb08aa2b61b6eac7070
9882e083aad0be394eef2bc511fbd204f670004b4ff09e627197805c5c7ceb9a
GET /v2.0/js/all.js HTTP/1.1
Host: site.yandex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.17.9
date: Sat, 23 Sep 2023 16:24:19 GMT
content-type: application/javascript
content-length: 15226
access-control-allow-origin: *
cache-control: public, max-age=216013
content-encoding: br
etag: "bec5d321335c0f9cabe51a146402ed2e"
expires: Tue, 26 Sep 2023 04:20:46 GMT
last-modified: Tue, 14 Feb 2023 08:57:29 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true
0 B URL accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://id-ransomware.blogspot.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:95IWkLmKMsHExWhGe8H8UaloDLZCHw:joVkoA7CPjzANsNH; Expires=Mon, 22-Sep-2025 16:24:19 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
location: https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-6y0ogjmuC1r_Ruq6_SNXrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: unsafe-none
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
resources.blogblog.com/img/navbar/icons_orange.png
200 OK 915 B URL GET HTTP/3 resources.blogblog.com/img/navbar/icons_orange.png
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=39330413
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type PNG image data, 46 x 20, 8-bit colormap, non-interlaced\012- data
Hash 87f25844d23ac1ee03604e668f5c1797
85d440947d70a78672740ff7e8062f68ce9d99a3
d70c36f2f61b735573caa3dd5a1602e19916701bb88d99ff4527cd2c89fa8b72
GET /img/navbar/icons_orange.png HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 915
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 22 Sep 2023 02:28:08 GMT
expires: Fri, 29 Sep 2023 02:28:08 GMT
cache-control: public, max-age=604800
last-modified: Thu, 21 Sep 2023 04:52:48 GMT
content-type: image/png
age: 136571
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
resources.blogblog.com/img/navbar/arrows-blue.png
200 OK 104 B URL GET HTTP/3 resources.blogblog.com/img/navbar/arrows-blue.png
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=39330413
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type PNG image data, 19 x 4, 8-bit/color RGBA, non-interlaced\012- data
Hash 38c95719e05f4184a301768d8de91e09
d0ed1147d46f2cf592584239a5a101d6f2abb588
259ece79a45ad7ecbcf6fb0669de61aa6a01ebedaba47a7e88283435e0e6b1be
GET /img/navbar/arrows-blue.png HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 104
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 21 Sep 2023 18:36:15 GMT
expires: Thu, 28 Sep 2023 18:36:15 GMT
cache-control: public, max-age=604800
last-modified: Thu, 21 Sep 2023 08:52:49 GMT
content-type: image/png
age: 164884
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
apis.google.com/js/platform:gapi.iframes.style.common.js
200 OK 22 kB URL GET HTTP/3 apis.google.com/js/platform:gapi.iframes.style.common.js
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=39330413
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (2664)
Hash 5ea6889749e35d1997d3d7b45b526cbe
b2be66a88cda67c0d38638906a19d3502db702f2
f8f1efe1d0d52a96dff5f0e285975b33bc89f9093c51e50024fa4c1d3810041f
GET /js/platform:gapi.iframes.style.common.js HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 21959
date: Sat, 23 Sep 2023 16:24:19 GMT
expires: Sat, 23 Sep 2023 16:24:19 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "fb306044a1b24cfb"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png
200 OK 910 B URL GET HTTP/3 www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type PNG image data, 42 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash efa6bb2bfe459bc6f4bdafa3db0383f6
52d15ce52fe50643e542c17812de43f4ed1b6ee0
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
GET /images/branding/googlelogo/1x/googlelogo_color_42x16dp.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 910
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 20 Sep 2023 18:59:20 GMT
expires: Thu, 19 Sep 2024 18:59:20 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
content-type: image/png
vary: Origin
age: 249899
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.gstatic.com/images/branding/product/2x/translate_24dp.png
200 OK 1.8 kB URL GET HTTP/3 www.gstatic.com/images/branding/product/2x/translate_24dp.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash c69c796362406f9e11c7f4bf5bb628da
e489ce95ab56208090868882113d7416abf46775
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
GET /images/branding/product/2x/translate_24dp.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.TpYxICw8iG4.L.F4.O/d=0/rs=AN8SPfrtPftKEg7PtUwWauRCo_c976LPSg/m=el_main_css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1842
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 18 Sep 2023 14:17:19 GMT
expires: Tue, 17 Sep 2024 14:17:19 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
vary: Origin
age: 439620
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
200 OK 3.3 kB URL GET HTTP/2 fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (6225), with no line terminators
Hash 2bd5c073a88b83ed74db88282a56ddfb
d0ebfc376f8c6a44a8d4cd216817dcd7d0c33650
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
GET /s/i/productlogos/translate/v14/24px.svg HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-length: 3340
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 20 Sep 2023 16:41:37 GMT
expires: Thu, 19 Sep 2024 16:41:37 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
age: 258162
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs
200 OK 45 kB URL GET HTTP/3 apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=39330413
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (1503)
Hash 216b38745f3cce08ced4200dd91c83a4
3f6bd3ee5da23060e704e8116b5a0961e20a80bf
a8183085f79cc939053929846561337bf0b9287aedece2d7eb154a87e572bab1
GET /_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 45424
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 18 Sep 2023 17:31:09 GMT
expires: Tue, 17 Sep 2024 17:31:09 GMT
cache-control: public, max-age=31536000
last-modified: Sat, 02 Sep 2023 15:18:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 427990
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=no&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback
1.4 kB URL translate-pa.googleapis.com/v1/supportedLanguages?client=te&display_language=no&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback
IP
Hash a3eefe14b1b4698460d992bd1673a26b
a2fca6ebb00b8bdcca3eda88654d02d2c165b9c4
87514750a90cd70dd22c8673cfa80d804ef55840bd0755950af2118d8d218067
GET /v1/supportedLanguages?client=te&display_language=no&key=AIzaSyBWDj0QJvVIx8XOhRegXX5_SrRWxhT5Hs4&callback=callback HTTP/1.1
Host: translate-pa.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
cross-origin-resource-policy: cross-origin
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-type: text/javascript; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Sat, 23 Sep 2023 16:24:19 GMT
server: ESF
cache-control: private
content-length: 1392
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: NID=511=Sft_57yQOr8-qgD3PeAx4fjDPyqJWYywUy_fYlEl70FRTl18z3SJ-RLx9dfh7m4w22Ts34ptMFg8pGNA8q8D4iIGjIB07d9Js8Uo_vUprkrc2h33nqBz2RSjznl17fh34D1QHrUKbAOFe6CesdTjdEDla1Rx3qVytP3hmycr5oE; expires=Sun, 24-Mar-2024 16:24:19 GMT; path=/; domain=.translate-pa.googleapis.com; HttpOnly
CONSENT=PENDING+410; expires=Mon, 22-Sep-2025 16:24:19 GMT; path=/; domain=.googleapis.com; Secure
expires: Sat, 23 Sep 2023 16:24:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
site.yandex.net/v2.0/js/suggest.js
200 OK 2.6 kB URL GET HTTP/2 site.yandex.net/v2.0/js/suggest.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGlobalSign nv-sa
Subject*.yastatic-net.ru
FingerprintD9:64:E0:F2:39:AC:36:DB:9A:A3:3D:E4:27:E4:0B:F5:5B:5B:E3:A0
ValidityMon, 10 Jul 2023 13:25:28 GMT - Sun, 07 Jan 2024 20:59:59 GMT
File type ASCII text, with very long lines (8487), with no line terminators
Hash 7b6f38e40b4c5677b862a187cb8b3e24
eb3bd440fe03c5157d81399d2a84b945d8c635a6
dc41be78fcb3b0ca16fc52b3026f8120ada7e9c8b6c1f989d84431ff689276cd
GET /v2.0/js/suggest.js HTTP/1.1
Host: site.yandex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.17.9
date: Sat, 23 Sep 2023 16:24:19 GMT
content-type: application/javascript
content-length: 2610
access-control-allow-origin: *
cache-control: public, max-age=216013
content-encoding: br
etag: "5905bc95497a3dcdd5543e8af9bb2553"
expires: Tue, 26 Sep 2023 04:22:39 GMT
last-modified: Tue, 14 Feb 2023 08:57:29 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes
X-Firefox-Spdy: h2
site.yandex.net/v2.0/js/opensearch.js
200 OK 6.2 kB URL GET HTTP/2 site.yandex.net/v2.0/js/opensearch.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGlobalSign nv-sa
Subject*.yastatic-net.ru
FingerprintD9:64:E0:F2:39:AC:36:DB:9A:A3:3D:E4:27:E4:0B:F5:5B:5B:E3:A0
ValidityMon, 10 Jul 2023 13:25:28 GMT - Sun, 07 Jan 2024 20:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (18552), with no line terminators
Hash d12257f87644c4e89830f47705dee860
06822268477a00b08ad6590e4992bf7d2a457ed6
de66288f054df7f389e8281f87fb0a9a05095149f4e96d13c32a1c3b61b1a4a3
GET /v2.0/js/opensearch.js HTTP/1.1
Host: site.yandex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.17.9
date: Sat, 23 Sep 2023 16:24:19 GMT
content-type: application/javascript
content-length: 6188
access-control-allow-origin: *
cache-control: public, max-age=216013
content-encoding: br
etag: "1df256fb3e065fdf3b47b6ac51380393"
expires: Tue, 26 Sep 2023 04:22:31 GMT
last-modified: Tue, 14 Feb 2023 08:57:29 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes
X-Firefox-Spdy: h2
site.yandex.net/v2.0/i/yandex-hint-rb.png
200 OK 425 B URL GET HTTP/2 site.yandex.net/v2.0/i/yandex-hint-rb.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGlobalSign nv-sa
Subject*.yastatic-net.ru
FingerprintD9:64:E0:F2:39:AC:36:DB:9A:A3:3D:E4:27:E4:0B:F5:5B:5B:E3:A0
ValidityMon, 10 Jul 2023 13:25:28 GMT - Sun, 07 Jan 2024 20:59:59 GMT
File type PNG image data, 26 x 11, 8-bit/color RGBA, non-interlaced\012- data
Hash fbe624b4939c4538e386beffac5861f6
3c8ed24d3d130de09ebb60b596808bf2c65baa56
3db7135d424b421c0c412fd4504afd0f744698be1df3f009027159627de5ff8f
GET /v2.0/i/yandex-hint-rb.png HTTP/1.1
Host: site.yandex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.17.9
date: Sat, 23 Sep 2023 16:24:19 GMT
content-type: image/png
content-length: 425
access-control-allow-origin: *
cache-control: public, max-age=216013
etag: "fbe624b4939c4538e386beffac5861f6"
expires: Tue, 26 Sep 2023 04:23:43 GMT
last-modified: Tue, 14 Feb 2023 08:57:29 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes
X-Firefox-Spdy: h2
site.yandex.net/v2.0/i/search.png
200 OK 771 B URL GET HTTP/2 site.yandex.net/v2.0/i/search.png
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGlobalSign nv-sa
Subject*.yastatic-net.ru
FingerprintD9:64:E0:F2:39:AC:36:DB:9A:A3:3D:E4:27:E4:0B:F5:5B:5B:E3:A0
ValidityMon, 10 Jul 2023 13:25:28 GMT - Sun, 07 Jan 2024 20:59:59 GMT
File type PNG image data, 19 x 15, 8-bit colormap, non-interlaced\012- data
Hash 95698da59d3786c4b32c0172ccf23009
dce5db37f233387eb2baa6318c30d967797e1206
49c6ca26c2e3b18d1ef9f08f6f5eb5d3b26ebf13fd246e717072b9075df6fd2f
GET /v2.0/i/search.png HTTP/1.1
Host: site.yandex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.17.9
date: Sat, 23 Sep 2023 16:24:19 GMT
content-type: image/png
content-length: 771
access-control-allow-origin: *
cache-control: public, max-age=216013
etag: "95698da59d3786c4b32c0172ccf23009"
expires: Tue, 26 Sep 2023 04:20:02 GMT
last-modified: Tue, 14 Feb 2023 08:57:29 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes
X-Firefox-Spdy: h2
translate.google.com/gen204?sl=ru&nca=te_ap&client=te&logld=vTE_20230920
204 No Content 0 B URL GET HTTP/3 translate.google.com/gen204?sl=ru&nca=te_ap&client=te&logld=vTE_20230920
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /gen204?sl=ru&nca=te_ap&client=te&logld=vTE_20230920 HTTP/1.1
Host: translate.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: image/gif; charset=us-ascii
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
cross-origin-resource-policy: cross-origin
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-security-policy: require-trusted-types-for 'script';report-uri /_/TranslateApiHttp/cspreport, script-src 'nonce-zgCYe2m-0mRh4y85kkvRCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateApiHttp/cspreport;worker-src 'self'
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: __Secure-ENID=15.SE=R95YNXyKa7Oyck4e2oWH5snbZZNjlwtJwnUqx5g4gSly05WfO7I_SpUfI-_fnPglVLnYZO4EY7ZYUBHSQPeFxKh0n7ZH20u69D-PsVPIbxVDvB1cm1vgpoRufro2G-yAmEgkVHJKY5wAbVpRLfALYjFjF_oVWWmKimobx8H0Y3U; expires=Wed, 23-Oct-2024 08:42:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1
3.3 kB URL www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (7988)
Hash 3ad09d18a77044988543166bcdd7c19b
c910aba7a7d030a58e24377bcfe89508e337f9a7
5a684af4be5b83957bb4543298c848b87a17323288b6844f1e2f6ee065c5ea70
GET /followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1 HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://id-ransomware.blogspot.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 3259
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
apis.google.com/js/platform.js
200 OK 22 kB URL GET HTTP/3 apis.google.com/js/platform.js
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (2664)
Hash ce7e88034e2b1226294f3d7e515299c9
326b37908964a9f69460d42cb646716c9f1e86e1
08280e7af6518c3230f34d50cb9534b35c82fddd96138896e2608d9a12661bbe
GET /js/platform.js HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 21949
date: Sat, 23 Sep 2023 16:24:20 GMT
expires: Sat, 23 Sep 2023 16:24:20 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "22f179323a7dd95a"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
id-ransomware.blogspot.com/favicon.ico
200 OK 765 B URL GET HTTP/3 id-ransomware.blogspot.com/favicon.ico
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint37:39:0F:F8:47:2E:23:CF:70:6A:2D:5A:34:A0:98:7E:C9:0F:5A:84
ValidityMon, 04 Sep 2023 08:22:52 GMT - Mon, 27 Nov 2023 08:22:51 GMT
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 59afcf22bd6a1dbe62b2cb4356e87404
bc7fa36c6533ad7d1027ed6655da9f4a4254ee32
027ca8fc1a8b8a79f7256eadf3d248129faaf4234165239430f28657b5fedae3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: id-ransomware.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Cookie: _ga_99EZ5NYFNR=GS1.1.1695486258.1.0.1695486258.0.0.0; _ga=GA1.1.1603073926.1695486259
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: image/x-icon
expires: Sat, 23 Sep 2023 16:24:20 GMT
date: Sat, 23 Sep 2023 16:24:20 GMT
cache-control: private, max-age=86400
last-modified: Thu, 21 Sep 2023 00:48:46 GMT
etag: W/"cb073105ed406e1406d72924d2ad7871ebf5dbbe4cb2af92908db0800913b3d2"
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 765
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a/default-user=s45-c
200 OK 316 B URL GET HTTP/3 lh3.googleusercontent.com/a/default-user=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 45 x 45, 8-bit colormap, non-interlaced\012- data
Hash 9fae1841320a0eaa434a022513f60859
245fac7a1ba86adda5bf5571babef7d5280672a4
1e2ce2743c2908d3aa1ce10a03be76d756eaa493cd41f9dcc94a3cc35cbfa1bd
GET /a/default-user=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.png"
x-content-type-options: nosniff
server: fife
content-length: 316
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:54:50 GMT
expires: Sun, 24 Sep 2023 13:54:50 GMT
cache-control: public, max-age=86400, no-transform
age: 8970
etag: "v0"
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjUZfRlaFvidH3U-RHDpw_PnYkFGr3YAfAaMzEmdwH6f0QQ=s45-c
200 OK 2.4 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjUZfRlaFvidH3U-RHDpw_PnYkFGr3YAfAaMzEmdwH6f0QQ=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash ce0f8e2405c769020ac94fe199ec35f8
4b84a9a49d337ebafee0493802d1d83477c57284
b906753b4f6fc6a82db852549911b7cabaeac28de18de46f1c804e808a8e853f
GET /a-/ALV-UjUZfRlaFvidH3U-RHDpw_PnYkFGr3YAfAaMzEmdwH6f0QQ=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 2436
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
etag: "v38c"
content-type: image/jpeg
vary: Origin
age: 10747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjWk7S8E-YExVwIO9RVTFmxBmD5y_OILa4vKzxwqsREX6kPT=s45-c
200 OK 4.8 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjWk7S8E-YExVwIO9RVTFmxBmD5y_OILa4vKzxwqsREX6kPT=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 45 x 45, 8-bit/color RGB, non-interlaced\012- data
Hash 7571328162c2363e4f461cb845f41560
76b33496b5a825d73b2d63f9011e199ddff6038a
3f0c6315eb1676d68dd4ff9db4093082e4356fdfa1440e743dd83634d911b4bd
GET /a-/ALV-UjWk7S8E-YExVwIO9RVTFmxBmD5y_OILa4vKzxwqsREX6kPT=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.png"
x-content-type-options: nosniff
server: fife
content-length: 4760
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
age: 10747
etag: "v6c7f"
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjWCUsnGl3fQ2V_rmXiW_7BV1iwxOC361I8N_Ys8VR6G=s45-c
200 OK 690 B URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjWCUsnGl3fQ2V_rmXiW_7BV1iwxOC361I8N_Ys8VR6G=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 45 x 45, 8-bit/color RGB, non-interlaced\012- data
Hash 59544955dfd770475d740cbb0dfc73ea
a0d6a58187b2bab1acfb9626a7eddbd1d9a08803
2621648b434e19f2d73c99d165ec85c9678e2b8c6806d719c5013407f33b9202
GET /a-/ALV-UjWCUsnGl3fQ2V_rmXiW_7BV1iwxOC361I8N_Ys8VR6G=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.png"
x-content-type-options: nosniff
server: fife
content-length: 690
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
content-type: image/png
vary: Origin
age: 10747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjV-2hI-ZNJQdSz8ej8Zi-iAaCBguqWLLYeqPrG_2d-3DxQ=s45-c
200 OK 1.7 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjV-2hI-ZNJQdSz8ej8Zi-iAaCBguqWLLYeqPrG_2d-3DxQ=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google, copyright=Copyright 2002], baseline, precision 8, 45x45, components 3\012- data
Hash 2445159051c0572e1c784d6a24092527
2aa0224c96b6b75aa3f8af5e9dcb75d4b7433e0b
823e8c47e328f6117c37bf1fa79edf9cc826b53dc37a982fead2119d90efa1e5
GET /a-/ALV-UjV-2hI-ZNJQdSz8ej8Zi-iAaCBguqWLLYeqPrG_2d-3DxQ=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 1679
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
etag: "v129"
content-type: image/jpeg
vary: Origin
age: 10747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjUli33G2IsxeJXRyUahb-gEaV2Pvyhz0qhsiWuk4eZWwA=s45-c
200 OK 2.1 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjUli33G2IsxeJXRyUahb-gEaV2Pvyhz0qhsiWuk4eZWwA=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash cdfe57187cbeb1cef657ff8d0f2242de
f872efd945ca3fde32ad4b458c973a830f15b71c
9f2b1b75b18c83d8420aa8fb59e8172369d09cd96c75b2a84954223511edeb56
GET /a-/ALV-UjUli33G2IsxeJXRyUahb-gEaV2Pvyhz0qhsiWuk4eZWwA=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 2119
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
age: 10747
etag: "vb"
content-type: image/jpeg
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjXMHP6Ulb0JbJy7GyFG7TBVW65TS-Ujp5ZyP4SgnNbOBsLu=s45-c
200 OK 2.1 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjXMHP6Ulb0JbJy7GyFG7TBVW65TS-Ujp5ZyP4SgnNbOBsLu=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash 31e6d29023fceb3a156bdcd9ee3f1d23
79f2c0f12820f6a5f0aa5ebaa747162f2d99605e
33416d96e95ddca35978e8e5cfc304ea0a6de0814746b7692a43434b7c2d599e
GET /a-/ALV-UjXMHP6Ulb0JbJy7GyFG7TBVW65TS-Ujp5ZyP4SgnNbOBsLu=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 2088
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
etag: "va02c"
content-type: image/jpeg
vary: Origin
age: 10747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes,gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs
200 OK 45 kB URL GET HTTP/3 apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes,gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (1503)
Hash 216b38745f3cce08ced4200dd91c83a4
3f6bd3ee5da23060e704e8116b5a0961e20a80bf
a8183085f79cc939053929846561337bf0b9287aedece2d7eb154a87e572bab1
GET /_/scs/abc-static/_/js/k=gapi.lb.en.L92w_vMR5kE.O/m=gapi_iframes,gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/cb=gapi.loaded_0?le=scs HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 45424
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 18 Sep 2023 17:31:05 GMT
expires: Tue, 17 Sep 2024 17:31:05 GMT
cache-control: public, max-age=31536000
last-modified: Sat, 02 Sep 2023 15:18:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 427995
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjXydF1zvRIuHQt5M1LiAQXOEw-erwLg34QADVpqCH-UxOE=s45-c
200 OK 3.7 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjXydF1zvRIuHQt5M1LiAQXOEw-erwLg34QADVpqCH-UxOE=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 45 x 45, 8-bit/color RGB, non-interlaced\012- data
Hash aa261af472a99be80d13a3a7a0c1e2f7
040e7ff7826f2fb8c86624adb19347bb7e328a06
7a9ca1363496db60c8d367bff704a61bb5a2b46e33bf574e6712906a54748476
GET /a-/ALV-UjXydF1zvRIuHQt5M1LiAQXOEw-erwLg34QADVpqCH-UxOE=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.png"
x-content-type-options: nosniff
server: fife
content-length: 3745
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:13 GMT
expires: Sun, 24 Sep 2023 13:25:13 GMT
cache-control: public, max-age=86400, no-transform
age: 10747
etag: "v129"
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjW68F9XiwhhrQzJxVaEK9YDUp23cdYBNQzAUbfMA1YcVWE=s45-c
200 OK 1.6 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjW68F9XiwhhrQzJxVaEK9YDUp23cdYBNQzAUbfMA1YcVWE=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash 201e8252adee7111188673cfe3436334
47a51091ad9140447ad24cae121a3759fede9816
ae3f58165578b0658c8654731986f2ae13e8b74f47c253181289c869eae20e82
GET /a-/ALV-UjW68F9XiwhhrQzJxVaEK9YDUp23cdYBNQzAUbfMA1YcVWE=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 1607
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:14 GMT
expires: Sun, 24 Sep 2023 13:25:14 GMT
cache-control: public, max-age=86400, no-transform
etag: "v8ac"
content-type: image/jpeg
vary: Origin
age: 10746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjV2vmKMgCxY-TVfxCBAHW-Rd-x0aZPzbXlXjYLksKV3ULU=s45-c
200 OK 2.7 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjV2vmKMgCxY-TVfxCBAHW-Rd-x0aZPzbXlXjYLksKV3ULU=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash b2393af41cc9babad6b0eeec2934a4e8
97e2c87c064d91ab6856dd7a2c69a83ecbb674c1
176bd9607cef1c79391be16d012929462cc05cbac004b399191dbe2aa938fbb0
GET /a-/ALV-UjV2vmKMgCxY-TVfxCBAHW-Rd-x0aZPzbXlXjYLksKV3ULU=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 2657
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:14 GMT
expires: Sun, 24 Sep 2023 13:25:14 GMT
cache-control: public, max-age=86400, no-transform
age: 10746
etag: "v1821"
content-type: image/jpeg
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjXJVlKYC6n4KCeIrnx9n25Is3FDGJCtdj-W8pq6RA37uw=s45-c
200 OK 737 B URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjXJVlKYC6n4KCeIrnx9n25Is3FDGJCtdj-W8pq6RA37uw=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 45 x 45, 8-bit/color RGB, non-interlaced\012- data
Hash b883e02f47f943d10e09341e94363f77
0dd015efc9c7a5c0442fba31221935e271597387
d7c4b895270cb5f55599a8d3bd9d0ea8175b73893b94e5f0d5dcea65ed6e156b
GET /a-/ALV-UjXJVlKYC6n4KCeIrnx9n25Is3FDGJCtdj-W8pq6RA37uw=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: image/png
vary: Origin
access-control-expose-headers: Content-Length
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: private, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.png"
x-content-type-options: nosniff
date: Sat, 23 Sep 2023 16:24:20 GMT
server: fife
content-length: 737
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjXF5O4NS-B1TSaNQ2I2Auyo7B8agol7DR-QdOJgtqxBeSdD=s45-c
200 OK 1.7 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjXF5O4NS-B1TSaNQ2I2Auyo7B8agol7DR-QdOJgtqxBeSdD=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash 390fc0e8e830e235f5ce4a7f08e8e610
3bed88638166d767f5efaae4497b312307a006a7
53e9de11b36c76023ae48219c24a3622d3009b49e75094ca9b9ab78d97e4905c
GET /a-/ALV-UjXF5O4NS-B1TSaNQ2I2Auyo7B8agol7DR-QdOJgtqxBeSdD=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 1662
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:08:31 GMT
expires: Sun, 24 Sep 2023 13:08:31 GMT
cache-control: public, max-age=86400, no-transform
age: 11749
etag: "v6d16"
content-type: image/jpeg
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjXHW3E1V9TwCYY4uO0BMTBMaj1skjA07zd1YGzFTdSZF6g=s45-c
200 OK 1.4 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjXHW3E1V9TwCYY4uO0BMTBMaj1skjA07zd1YGzFTdSZF6g=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash 9dd518a0013ab12f81d2ba4700ebb37a
4cbd86e5594cadb1816567d19806f33bea802ab2
dfcad16ecf86d6cc21bdc9e1eb352af78da14a9cacc3696d3a9eed6346fcdb1a
GET /a-/ALV-UjXHW3E1V9TwCYY4uO0BMTBMaj1skjA07zd1YGzFTdSZF6g=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 1419
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:14 GMT
expires: Sun, 24 Sep 2023 13:25:14 GMT
cache-control: public, max-age=86400, no-transform
age: 10746
etag: "v1c42"
content-type: image/jpeg
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjXDIXsWMOOz-vNH4dyxsRfr9nJhQpxt_twPYzeeDWhaq6n7=s45-c
200 OK 2.8 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjXDIXsWMOOz-vNH4dyxsRfr9nJhQpxt_twPYzeeDWhaq6n7=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=3, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash abdca690fc1a4b66863cee73c31d3c37
87a04d677869c0bb0550cc85cb86531b40756b07
9e5c3f78416aabb051d7fdd45cf88169b962e95483c023b9559c32b7ceefdffa
GET /a-/ALV-UjXDIXsWMOOz-vNH4dyxsRfr9nJhQpxt_twPYzeeDWhaq6n7=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 2839
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:14 GMT
expires: Sun, 24 Sep 2023 13:25:14 GMT
cache-control: public, max-age=86400, no-transform
etag: "v2bfe3"
content-type: image/jpeg
vary: Origin
age: 10746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
lh3.googleusercontent.com/a-/ALV-UjUhNwvBjlhTPjZVcC3lZDaPfKnnKXwelG0mMdPvqxkfzJho=s45-c
200 OK 2.0 kB URL GET HTTP/3 lh3.googleusercontent.com/a-/ALV-UjUhNwvBjlhTPjZVcC3lZDaPfKnnKXwelG0mMdPvqxkfzJho=s45-c
IP
Requested by https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1#id=I0_1695486258371&_gfid=I0_1695486258371&parent=https%3A%2F%2Fid-ransomware.blogspot.com&pfname=&rpctoken=19271687
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 45x45, components 3\012- data
Hash da155148959875eb70c2c4a53183ff0c
d9f193cb11ec738787ba5e05bace9ad21ff054e5
c8187c9d2e00d2da42fb94619f804711f448242fa947bfb342e81d062a103b03
GET /a-/ALV-UjUhNwvBjlhTPjZVcC3lZDaPfKnnKXwelG0mMdPvqxkfzJho=s45-c HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
server: fife
content-length: 2000
x-xss-protection: 0
date: Sat, 23 Sep 2023 13:25:14 GMT
expires: Sun, 24 Sep 2023 13:25:14 GMT
cache-control: public, max-age=86400, no-transform
etag: "v9bc5"
content-type: image/jpeg
vary: Origin
age: 10746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/static/v1/v-css/3268905543-lightbox_bundle.css
200 OK 6.5 kB URL GET HTTP/3 www.blogger.com/static/v1/v-css/3268905543-lightbox_bundle.css
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type ASCII text, with very long lines (35889), with no line terminators
Hash e287450e0a5c5a5625f7ba3716c1b0cf
3287eee808b2a77f7e4ea16b148f4cd173cddb66
5ee6fb081a76cfc34678b67e894a1fa91ed96857c4d94710cb1a8cea5ea1d76b
GET /static/v1/v-css/3268905543-lightbox_bundle.css HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 6501
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 19 Sep 2023 04:10:18 GMT
expires: Wed, 18 Sep 2024 04:10:18 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 18 Sep 2023 13:58:14 GMT
content-type: text/css
vary: Accept-Encoding
age: 389642
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/static/v1/jsbin/3513472742-lbx__ru.js
200 OK 124 kB URL GET HTTP/3 www.blogger.com/static/v1/jsbin/3513472742-lbx__ru.js
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type ASCII text, with very long lines (1308)
Size 124 kB (123830 bytes)
Hash 0fafb1f96b5dcdc0699c953cc7d5982a
74347fb52b2fd509d1c377d3c2790d84796ad3d7
48d43c468c62b9099dcad30478e355c2663f801a12d45726941b6c3da278d5fb
GET /static/v1/jsbin/3513472742-lbx__ru.js HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 123830
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 20 Sep 2023 02:54:01 GMT
expires: Thu, 19 Sep 2024 02:54:01 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 20 Sep 2023 00:55:53 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 307819
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
200 OK 0 B URL POST HTTP/3 translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintBE:40:3A:A6:DE:CC:A7:8B:75:43:68:F2:F9:56:63:71:49:61:06:49
ValidityMon, 04 Sep 2023 08:23:18 GMT - Mon, 27 Nov 2023 08:23:17 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /element/log?format=json&hasfast=true&authuser=0 HTTP/1.1
Host: translate.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-encoding,content-type,x-goog-authuser
Referer: https://id-ransomware.blogspot.com/
Origin: https://id-ransomware.blogspot.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: https://id-ransomware.blogspot.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin
content-type: text/plain; charset=UTF-8
date: Sat, 23 Sep 2023 16:24:29 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: CONSENT=PENDING+009; expires=Mon, 22-Sep-2025 16:24:29 GMT; path=/; domain=.googleapis.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 23 Sep 2023 16:24:29 GMT
cache-control: private
translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
200 OK 131 B URL POST HTTP/3 translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintBE:40:3A:A6:DE:CC:A7:8B:75:43:68:F2:F9:56:63:71:49:61:06:49
ValidityMon, 04 Sep 2023 08:23:18 GMT - Mon, 27 Nov 2023 08:23:17 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash ca0b7e866005f6774d284b9f438ebfd2
53644f5ee3640189bdb223473ba6a2d46606c556
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
POST /element/log?format=json&hasfast=true&authuser=0 HTTP/1.1
Host: translate.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-AuthUser: 0
Content-Encoding: gzip
Content-Type: application/binary
Content-Length: 325
Origin: https://id-ransomware.blogspot.com
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: https://id-ransomware.blogspot.com
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web
content-type: text/plain; charset=UTF-8
content-encoding: gzip
date: Sat, 23 Sep 2023 16:24:29 GMT
server: Playlog
cache-control: private
content-length: 131
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: CONSENT=PENDING+291; expires=Mon, 22-Sep-2025 16:24:29 GMT; path=/; domain=.googleapis.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 23 Sep 2023 16:24:29 GMT
accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true
302 Found 13 kB URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint2F:C1:71:0A:05:D9:0F:38:EF:D1:16:F7:50:AF:41:48:6B:F9:BA:B5
ValidityMon, 04 Sep 2023 08:23:30 GMT - Mon, 27 Nov 2023 08:23:29 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://id-ransomware.blogspot.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:95IWkLmKMsHExWhGe8H8UaloDLZCHw:joVkoA7CPjzANsNH; Expires=Mon, 22-Sep-2025 16:24:19 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
location: https://www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-6y0ogjmuC1r_Ruq6_SNXrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: unsafe-none
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
200 OK 87 kB URL GET HTTP/2 translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintBB:B9:27:FB:7D:F3:A7:1A:57:CC:23:F8:42:E9:10:BE:59:7E:1F:D4
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (2450)
Hash a383c13662045386624e29b40880c8b2
f54ceaf8ed74ff5fd94a17fda657a66c61294e14
24a757a4565788097dbb2fb2b5146e72eac5043bc600d51820f072953d125888
GET /translate_a/element.js?cb=googleTranslateElementInit HTTP/1.1
Host: translate.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:17 GMT
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: CONSENT=PENDING+278; expires=Mon, 22-Sep-2025 16:24:17 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
200 OK 6.9 kB URL GET HTTP/3 www.blogger.com/navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (7098), with no line terminators
Hash f1a5107746e648de4e9a2781421888c7
9e76c011a0f919fa12a69efd9b0318f5c2e2563f
e9cd8b6864d8f0037318d39a65dce07b88a92f50f5c5351949b6d3d0361d11b2
GET /navbar.g?targetBlogID=6113896202570680354&blogName=%D0%A8%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D1%8C%D1%89%D0%B8%D0%BA%D0%B8-%D0%B2%D1%8B%D0%BC%D0%BE%D0%B3%D0%B0%D1%82%D0%B5%D0%BB%D0%B8+The+Digest+%22...&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=BLUE&layoutType=LAYOUTS&searchRoot=https://id-ransomware.blogspot.com/search&blogLocale=ru&v=2&homepageUrl=https://id-ransomware.blogspot.com/&targetPostID=6149622016432706255&blogPostOrPageUrl=https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html&vt=-2683584919548720758&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__ HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 2711
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
302 Found 13 kB URL GET HTTP/3 www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.L92w_vMR5kE.O%2Fd%3D1%2Frs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA%2Fm%3D__features__ HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://id-ransomware.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
location: https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D6113896202570680354%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50%26pageSize%3D21%26postID%3D6149622016432706255%26origin%3Dhttps://id-ransomware.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.L92w_vMR5kE.O/d%253D1/rs%253DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%253D__features__%26bpli%3D1&go=true
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Sat, 23 Sep 2023 16:24:19 GMT
expires: Sat, 23 Sep 2023 16:24:19 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 546
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1
200 OK 13 kB URL GET HTTP/3 www.blogger.com/followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1
IP
Requested by https://id-ransomware.blogspot.com/2017/03/cryptomeister-ransomware.html
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
FingerprintCB:2E:4E:04:8F:48:B1:A1:1A:F4:F6:E1:8A:18:2F:F9:B5:A6:DD:60
ValidityMon, 04 Sep 2023 08:16:44 GMT - Mon, 27 Nov 2023 08:16:43 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /followers.g?blogID=6113896202570680354&colors=Cgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM0NDQ0NDQiByMyODVkOGMqByNkNGUxZmYyByM2NjY2NjY6ByM0NDQ0NDRCByMyODVkOGNKByM2NjY2NjZSByMyODVkOGNaC3RyYW5zcGFyZW50&pageSize=21&postID=6149622016432706255&origin=https://id-ransomware.blogspot.com/&usegapi=1&jsh=m;/_/scs/abc-static/_/js/k%3Dgapi.lb.en.L92w_vMR5kE.O/d%3D1/rs%3DAHpOoo-GjmyR8TQVDKPrbqj5UQg7cU3cCA/m%3D__features__&bpli=1 HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://id-ransomware.blogspot.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 23 Sep 2023 16:24:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 3259
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
216.58.207.193
178.154.131.215
54.37.238.86
0.0.0.0