news.sophos.com
Open in
urlscan Pro
2a04:fa87:fffd::c000:42c8
Public Scan
Effective URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/
Submission: On September 03 via api from US
Summary
TLS certificate: Issued by R3 on July 21st 2021. Valid for: 3 months.
This is the only time news.sophos.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-229-66.deploy.static.akamaitechnologies.com
img03.en25.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-228-151.compute-1.amazonaws.com
tags.srv.stackadapt.com |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com
px4.ads.linkedin.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-51-212.compute-1.amazonaws.com
q.quora.com |
ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net
www.googleadservices.com |
ASN32934 (FACEBOOK, US)
www.facebook.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-13-173.eu-west-1.compute.amazonaws.com
match.prod.bidr.io |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-114.fra60.r.cloudfront.net
segments.company-target.com |
ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-138-57.eu-west-1.compute.amazonaws.com
insight.adsrvr.org |
Domain | Requested by | |
---|---|---|
20 | news.sophos.com |
t.co
news.sophos.com |
4 | tags.srv.stackadapt.com |
t.co
tags.srv.stackadapt.com |
3 | bat.bing.com |
t.co
bat.bing.com news.sophos.com |
3 | stats.g.doubleclick.net |
1 redirects
news.sophos.com
|
2 | segments.company-target.com |
1 redirects
news.sophos.com
|
2 | match.prod.bidr.io | 2 redirects |
2 | www.facebook.com |
news.sophos.com
|
2 | px.ads.linkedin.com | 2 redirects |
2 | www.google.de |
news.sophos.com
|
2 | www.google.com |
1 redirects
news.sophos.com
|
2 | s.yimg.com |
t.co
s.yimg.com |
2 | connect.facebook.net |
t.co
connect.facebook.net |
2 | www.googletagmanager.com |
news.sophos.com
www.googletagmanager.com |
2 | t.co |
news.sophos.com
|
1 | insight.adsrvr.org |
js.adsrvr.org
|
1 | id.rlcdn.com |
news.sophos.com
|
1 | api.company-target.com |
scripts.demandbase.com
|
1 | googleads.g.doubleclick.net |
www.googleadservices.com
|
1 | analytics.twitter.com |
static.ads-twitter.com
|
1 | www.googleadservices.com |
www.googletagmanager.com
|
1 | q.quora.com |
news.sophos.com
|
1 | px4.ads.linkedin.com |
news.sophos.com
|
1 | www.linkedin.com | 1 redirects |
1 | js.adsrvr.org |
www.googletagmanager.com
|
1 | a.quora.com |
t.co
|
1 | static.ads-twitter.com |
t.co
|
1 | scripts.demandbase.com |
t.co
|
1 | snap.licdn.com |
t.co
|
1 | pixel.wp.com |
news.sophos.com
|
1 | img03.en25.com |
news.sophos.com
|
1 | stats.wp.com |
news.sophos.com
|
1 | cdn.jsdelivr.net |
news.sophos.com
|
60 | 32 |
This site contains links to these domains. Also see Links.
Domain |
---|
ai.sophos.com |
nakedsecurity.sophos.com |
www.microsoft.com |
docs.microsoft.com |
www.bbc.com |
www.facebook.com |
twitter.com |
www.linkedin.com |
www.sophos.com |
secure.ethicspoint.eu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS RSA SHA256 2020 CA1 |
2021-02-05 - 2022-02-04 |
a year | crt.sh |
news.sophos.com R3 |
2021-07-21 - 2021-10-19 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020 |
2021-04-30 - 2022-06-01 |
a year | crt.sh |
*.wp.com Sectigo RSA Domain Validation Secure Server CA |
2020-04-02 - 2022-07-05 |
2 years | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
*.en25.com DigiCert SHA2 Secure Server CA |
2020-08-13 - 2021-11-12 |
a year | crt.sh |
www.bing.com Microsoft RSA TLS CA 02 |
2021-07-06 - 2022-01-06 |
6 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-06-13 - 2021-09-11 |
3 months | crt.sh |
*.licdn.com DigiCert SHA2 Secure Server CA |
2021-04-30 - 2022-05-11 |
a year | crt.sh |
tag.demandbase.com Go Daddy Secure Certificate Authority - G2 |
2020-10-14 - 2021-11-15 |
a year | crt.sh |
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-07-21 - 2022-07-26 |
a year | crt.sh |
quora.com R3 |
2021-08-22 - 2021-11-20 |
3 months | crt.sh |
*.srv.stackadapt.com Amazon |
2020-12-09 - 2022-01-07 |
a year | crt.sh |
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020 |
2021-03-18 - 2022-04-19 |
a year | crt.sh |
*.yahoo.com DigiCert SHA2 High Assurance Server CA |
2021-07-26 - 2021-09-15 |
2 months | crt.sh |
www.google.de GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
px.ads.linkedin.com DigiCert SHA2 Secure Server CA |
2021-04-15 - 2021-10-15 |
6 months | crt.sh |
*.quora.com R3 |
2021-08-22 - 2021-11-20 |
3 months | crt.sh |
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-02-05 - 2022-02-04 |
a year | crt.sh |
*.google.com GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
api.demandbase.com Go Daddy Secure Certificate Authority - G2 |
2020-10-09 - 2021-10-28 |
a year | crt.sh |
*.company-target.com Amazon |
2021-08-31 - 2022-09-29 |
a year | crt.sh |
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA |
2021-02-25 - 2022-03-28 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/
Frame ID: 5EE8A5BDFB9B2E7B588BE0162ED68B4E
Requests: 59 HTTP requests in this frame
Frame:
https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&upid=ql4fc2b&upv=1.1.0
Frame ID: 16726DB4D6840C291E55269F5810EAEB
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Conti affiliates use ProxyShell Exchange exploit in ransomware attacks – Sophos NewsPage URL History Show full URLs
- https://t.co/jkowYnpZKM Page URL
- https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomw... Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- script /\/wp-(?:content|includes)\//i
- meta generator /^WordPress ?([\d.]+)?/i
PHP (Programming Languages) Expand
Detected patterns
- script /\/wp-(?:content|includes)\//i
- meta generator /^WordPress ?([\d.]+)?/i
MySQL (Databases) Expand
Detected patterns
- script /\/wp-(?:content|includes)\//i
- meta generator /^WordPress ?([\d.]+)?/i
Facebook (Widgets) Expand
Detected patterns
- script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /<!-- (?:End )?Google Tag Manager -->/i
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
Title: AI Research
Search URL Search Domain Scan URL
Title: Security News & Tips
Search URL Search Domain Scan URL
Title: recently leaked set of documentation attributed to Conti’s operators
Search URL Search Domain Scan URL
Title: at least the CU19 version, released in December, 2020
Search URL Search Domain Scan URL
Title: Microsoft Exchange “cmdlets”
Search URL Search Domain Scan URL
Title: Evil Corp
Search URL Search Domain Scan URL
Title: Share on Facebook
Search URL Search Domain Scan URL
Title: Share on Twitter
Search URL Search Domain Scan URL
Title: Share on LinkedIn
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Privacy Notice
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: General
Search URL Search Domain Scan URL
Title: Modern Slavery Statement
Search URL Search Domain Scan URL
Title: Speak Out
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/jkowYnpZKM Page URL
- https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 36- https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=512926439&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&utmhid=473012680&utmr=https%3A%2F%2Ft.co%2F&utmp=%2Fcorpblog%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&utmht=1630680043272&utmac=UA-737537-1&utmcc=__utma%3D1.796663343.1630680043.1630680043.1630680043.1%3B%2B__utmz%3D1.1630680043.1.1.utmcsr%3Dt.co%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=1898991489&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=796663343.1630680043&jid=1898991489&_v=5.7.2dc&z=512926439 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=796663343.1630680043&jid=1898991489&_v=5.7.2dc&z=512926439&slf_rd=1&random=3810599701
- https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630680043297&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F HTTP 302
- https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1630680043297%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F09%252F03%252Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%252F%26liSync%3Dtrue HTTP 302
- https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630680043297&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&liSync=true HTTP 302
- https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630680043297&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&liSync=true&e_ipv6=AQIgGShk7S9GwAAAAXusGtCqLZldMkN7hFlnSo34-fB4UHYxMx-NvJ0CDHyZvx6guktHGV53
- https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
- https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
- https://segments.company-target.com/log?vendor=choca&user_id=AABuuk7CZGgAABkaM27zgw HTTP 303
- https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABuuk7CZGgAABkaM27zgw&verifyHash=e53ccb535fbf9c88ad2f97aa45e59847cf9e400c
60 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
jkowYnpZKM
t.co/ |
496 B 566 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ |
73 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
news.sophos.com/_static/ |
233 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
news.sophos.com/_static/ |
98 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Category-Icon-Security-Operations@2x_r2.min_.png
news.sophos.com/wp-content/uploads/2021/06/ |
41 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sean-gallagher.jpg
news.sophos.com/wp-content/uploads/2020/02/ |
16 KB 16 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Peter-Mackenzie.jpg
news.sophos.com/wp-content/uploads/2019/09/ |
4 KB 5 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
107 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-emoji-release.min.js
news.sophos.com/wp-includes/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
news.sophos.com/_static/ |
135 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alpine.min.js
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/ |
26 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
news.sophos.com/_static/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e-202135.js
stats.wp.com/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sophos-ransomware-web-banner-1200x628px-option-2.png
news.sophos.com/wp-content/uploads/2021/05/ |
75 KB 75 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sophos-edr-news-blog-image-838x440px@2x.png
news.sophos.com/wp-content/uploads/2021/05/ |
11 KB 11 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sophos-xdr.png
news.sophos.com/wp-content/uploads/2021/05/ |
39 KB 39 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SophosSans-Light.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SophosSans-Medium.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SophosSans-Semibold.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contishell-1.jpg
news.sophos.com/wp-content/uploads/2021/09/ |
154 KB 154 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conti-proxyshell_cmdlet-1.png
news.sophos.com/wp-content/uploads/2021/09/ |
22 KB 22 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conti-proxyshell_cmdlet2.png
news.sophos.com/wp-content/uploads/2021/09/ |
21 KB 21 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conti-proxyshell_cmdlet3.png
news.sophos.com/wp-content/uploads/2021/09/ |
24 KB 24 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
evilcorp.jpg
news.sophos.com/wp-content/uploads/2021/09/ |
327 KB 327 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dc.js
stats.g.doubleclick.net/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
elqCfg.min.js
img03.en25.com/i/ |
6 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
g.gif
pixel.wp.com/ |
50 B 115 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
js
www.googletagmanager.com/gtag/ |
96 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bat.js
bat.bing.com/ |
30 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
99 KB 26 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
insight.min.js
snap.licdn.com/li.lms-analytics/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WuEFNglz.min.js
scripts.demandbase.com/ |
61 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uwt.js
static.ads-twitter.com/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qevents.js
a.quora.com/ |
39 KB 14 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
events.js
tags.srv.stackadapt.com/ |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
up_loader.1.1.0.js
js.adsrvr.org/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ytc.js
s.yimg.com/wi/ |
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 107 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
__utm.gif
stats.g.doubleclick.net/r/ |
35 B 55 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
334990480506518
connect.facebook.net/signals/config/ |
306 KB 87 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
px4.ads.linkedin.com/ Redirect Chain
|
0 63 B |
Image
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4015302.js
bat.bing.com/p/action/ |
0 92 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0
bat.bing.com/action/ |
0 95 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10150886.json
s.yimg.com/wi/config/ |
2 B 496 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel
q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/ |
43 B 423 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion_async.js
www.googleadservices.com/pagead/ |
36 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsct
analytics.twitter.com/i/ |
31 B 659 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsct
t.co/i/ |
43 B 360 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
44 B 147 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
/
www.google.com/pagead/1p-user-list/743773256/ |
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/743773256/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ip.json
api.company-target.com/api/v2/ |
430 B 934 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
validateCookie
segments.company-target.com/ Redirect Chain
|
26 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
464526.gif
id.rlcdn.com/ |
0 66 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sa.css
tags.srv.stackadapt.com/ |
82 B 309 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sa.jpeg
tags.srv.stackadapt.com/ |
0 881 B |
Fetch
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
/
www.facebook.com/tr/ |
44 B 91 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
up
insight.adsrvr.org/track/ Frame 1672 |
0 182 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
saq_pxl
tags.srv.stackadapt.com/ |
94 B 397 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
76 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| _wpemojiSettings undefined| $ function| jQuery object| PG8Data object| PG8 object| Sophos function| Cookies object| Stickyfill function| Spinner function| Tether function| Drop object| _gaq object| Alpine object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| addComment object| wp object| _stq function| st_go function| linktracker_init object| wpcom object| twemoji function| postscribe object| google_tag_manager_external object| google_tag_manager object| google_tag_data object| uetq function| fbq function| _fbq string| _linkedin_partner_id object| _linkedin_data_partner_ids function| twq function| qp function| saq function| _saq object| dotq object| _gat object| gaGlobal object| _elqQ object| _elq function| lintrk boolean| _already_called_lintrk function| UET function| UET_init function| UET_push object| twttr object| YAHOO object| qevents function| gtag function| ttd_dom_ready function| TTDUniversalPixelApi function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| __extends object| Demandbase object| __db function| DBSegment function| ga object| res string| current_window_url_param15 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.sophos.com/ | Name: _fbp Value: fb.1.1630680043353.1205252373 |
|
.news.sophos.com/ | Name: __utmb Value: 204943247.1.10.1630680043 |
|
.sophos.com/ | Name: __utmz Value: 1.1630680043.1.1.utmcsr=t.co|utmccn=(referral)|utmcmd=referral|utmcct=/ |
|
.sophos.com/ | Name: __utmb Value: 1.1.10.1630680043 |
|
.sophos.com/ | Name: CampaignID Value: 70130000001xKqzAAE |
|
.news.sophos.com/ | Name: __utmt_news Value: 1 |
|
.sophos.com/ | Name: __utmt Value: 1 |
|
.sophos.com/ | Name: _uetvid Value: eabd53800cc411ecaefdefff5729f4e6 |
|
.news.sophos.com/ | Name: __utma Value: 204943247.97964108.1630680043.1630680043.1630680043.1 |
|
.sophos.com/ | Name: __utmc Value: 1 |
|
.sophos.com/ | Name: _uetsid Value: eabd15c00cc411ec87e81138e5e5dde9 |
|
.sophos.com/ | Name: __utma Value: 1.796663343.1630680043.1630680043.1630680043.1 |
|
.news.sophos.com/ | Name: __utmz Value: 204943247.1630680043.1.1.utmcsr=t.co|utmccn=(referral)|utmcmd=referral|utmcct=/ |
|
.news.sophos.com/ | Name: __utmc Value: 204943247 |
|
.sophos.com/ | Name: _gcl_au Value: 1.1.591923444.1630680043 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.quora.com
analytics.twitter.com
api.company-target.com
bat.bing.com
cdn.jsdelivr.net
connect.facebook.net
googleads.g.doubleclick.net
id.rlcdn.com
img03.en25.com
insight.adsrvr.org
js.adsrvr.org
match.prod.bidr.io
news.sophos.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
s.yimg.com
scripts.demandbase.com
segments.company-target.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
stats.wp.com
t.co
tags.srv.stackadapt.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
104.111.229.66
104.244.42.195
104.244.42.197
108.174.10.14
13.32.121.114
142.250.185.66
151.101.12.157
151.101.13.2
18.205.51.212
18.66.112.89
18.66.96.113
18.66.97.46
192.0.76.3
2620:119:50e3:101::6cae:b45
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:80:800::7000
2a00:1450:4001:80f::2008
2a00:1450:4001:812::2008
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:831::2004
2a00:1450:400c:c08::9c
2a00:1450:400c:c08::9d
2a02:26f0:6c00:296::25ea
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:3::485
2a04:fa87:fffd::c000:42c8
34.255.138.57
35.244.174.68
52.202.228.151
54.246.13.173
03df94b79b4cd661af63f5fd3323cf20d45825f4da91582b900133264b936765
068b1a66d253cba54a9aa5dcd532fce67d168918e90d351a4140cf01dd63b380
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
100a028ae952bcb43d9bd5a80fef3563209eaf18a029ab7b400976bdc82deb8d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3e5b1810e546aefebd1e8a5fbcaf01a65c55ebbb4085cb2ef2481e59164f0e15
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55eaca0d345f2747157c721e6bf4ae70dd3777649dc627738055d80ac763b3dc
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257
5ca111362ea67a9e1c307cfafbb89eab2fda232ef53218043849ce6cb3cd5131
5de1941483bd29992f17c37717fbd7f3554e4801247e4e80cf2ef0125fae5316
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
632adbe6ad11ec159079391311ff0ad317ad1c52890365dbfeb497fedabfaebb
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
7c86be9bc6e3748483477cf752afd53a1b5fae97dc9b0004786ccc123124a2fe
7e8ee8f9d56ca7e35629a7c16b9f1c09fbb1e7d19fe922833a2f4edec48bfeea
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
893fbc7411366517dbfeaed7d1da3dfda7d94b3cba1ba756409c099c8b6666f5
a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff
a53b289843b15d58a9574645ea05db23c5dd6663fc5e39f5c61528ae13de22f5
a8559142717ac966a99198a16039f553c6258f3fe4622143b674f7ebe59d10db
a9ad76f46af6c33c9a809d19ebfe9a743a437217f3c2c19fc7d7083674b7e766
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b06995c16ddb8a51f17eac325487bd530b9abba0ae814fc20b47f171ce97b57a
b276efdcd262ee443ffb432b953eb94c8ae1e1624eee5f3409da02a48c5b768c
b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6
bd83358a15f76cc031ddf566a6cc1e16f8a86570aeea439bfb3a51bea4786970
bf46dd7258de2cf2dc0ffe34aeeb6381fe95edc2f4abe0cae7f58aa14f8ab01c
c4f06124757674060e21a2f49964bb1fc6785c5dcaf4abf69b83b40517b27510
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
d60b73d55aed17b7121e54d535602c04a3dce36a90ce83ce95c60a3995838334
db69868b71ea6e03c6e2eb39fe1fda731b9ea601269dd08d9be3fe86a54fb76b
de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f
efe76618a6283f2c8a959c4c9e680c7102d792ec4f818147a0c4f897c3d5a39a
f2d7cb550d69d56f0be728fa2dbe54bfe6179593314bbd858428a62b319f0eed
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530
fc56458e534d5f2b52c1b68f2671fff6a4f02b1891f20216460670628f09b719
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3