news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

45 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1886160334&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&utmhid=1911250402&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&utmht=1611901030615&utmac=UA-737537-1&utmcc=__utma%3D1.844060608.1611901031.1611901031.1611901031.1%3B%2B__utmz%3D1.1611901031.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1727076947&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=844060608.1611901031&jid=1727076947&_v=5.7.2dc&z=1886160334 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=844060608.1611901031&jid=1727076947&_v=5.7.2dc&z=1886160334&slf_rd=1&random=2174471769

Request Chain 48

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611901030669&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1611901030669%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F01%252F26%252Fnefilim-ransomware-attack-uses-ghost-credentials%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611901030669&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&liSync=true

Request Chain 54

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AAEvHU7AJ1EAABEvcHHRag HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEvHU7AJ1EAABEvcHHRag&verifyHash=7c9ecadf032a3076b0475fcf9ba15179e9de78df

57 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/	42 KB 12 KB	458ms 430ms	Document text/html	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / WordPress VIP <https://wpvip.com> Resource Hash d09134205cab3b30759c2219ff841afc14efb0bf475cc3914b221e62354a7785 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority news.sophos.com :scheme https :path /en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Fri, 29 Jan 2021 06:17:10 GMT content-type text/html; charset=UTF-8 x-hacker If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header. x-powered-by WordPress VIP <https://wpvip.com> host-header a9130478a60e5f9135f765b23f26593b link <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/72133>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=72133>; rel=shortlink content-encoding gzip x-rq hhn2 102 104 3107 cache-control max-age=300, must-revalidate age 0 x-cache miss vary Accept-Encoding accept-ranges bytes strict-transport-security max-age=31536000
GET H2	200	/ news.sophos.com/_static/	453 KB 198 KB	6ms 6ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6906c618e970bb59fb5a787b726cc847bcfa3ab2e6a963376389f7d6f833a778 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-rq hhn2 102 104 3107 last-modified Tue, 05 Jan 2021 23:19:30 GMT server nginx age 1254650 vary Accept-Encoding x-cache hit content-type text/css;charset=utf-8 cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 202598
GET H2	200	/ Show response news.sophos.com/_static/	98 KB 34 KB	15ms 15ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZgbmJmZmRqVEWAK9xIh8= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7eb243627ed4013b84418c9fe94ee3b9907906ace4de00965ff3b3b33a9f151c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-rq hhn2 102 104 3107 last-modified Tue, 08 Dec 2020 22:24:12 GMT server nginx age 519383 vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 34537
GET H2	200	avatar-three.png news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/	2 KB 2 KB	5ms 5ms	Image image/png	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/avatar-three.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b85ed9ff65cb89798ff1ac4b0d9a9b2c2d14f27a949ac3c19bae5c228ecc8f38 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 103 47 3084 last-modified Thu, 29 Oct 2020 17:01:28 GMT server nginx age 7334585 etag "5f9af568-7ba" strict-transport-security max-age=31536000 x-cache hit content-type image/png cache-control max-age=31536000 accept-ranges bytes content-length 1978 expires Sat, 29 Jan 2022 06:17:10 GMT
GET H2	200	facebook-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	600 B 905 B	176ms 90ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/facebook-icon.svg?la=en&hash=1CA0A5A0E9C9999E7E079A5D32C86E9BF9C7AD1E Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash c87eb0c349fe4518e3ffd3d05b3f43f90d4f8709eb7f9924e74e858a6efdb6ed Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 1194, 1194, 1194 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 33, 0 server-timing cdn-cache; desc=HIT, edge; dur=59 content-length 395 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:34:25 GMT x-frame-options SAMEORIGIN date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=387 expires Fri, 29 Jan 2021 06:23:37 GMT
GET H2	200	instagram-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	2 KB 2 KB	457ms 372ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/instagram-icon.svg?la=en&hash=2B50C2B67C3023D9E7D4E1C3A16401EAD8F10F76 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash 9f67d83d034c658809bf7a06ff6d74a417ea25a0005f4561abd5254652b6d7c6 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 1687, 1687, 1687, 1805, 1687, 1687, 1687 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 31, 0, 1, 1, 2, 106 server-timing cdn-cache; desc=HIT, edge; dur=333 content-length 990 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:37:54 GMT x-frame-options SAMEORIGIN date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=109 expires Fri, 29 Jan 2021 06:18:59 GMT
GET H2	200	linkedin-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	923 B 1 KB	199ms 114ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/linkedin-icon.svg?la=en&hash=B6D5378C1E1A16F239A4C862EAE3499B8EC1F3F9 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash c6f378c4d31ede24622009dc2d5e85386926ea9881e94326252146bff0fd5110 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 771, 771, 771, 897, 771, 771 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 31, 2, 0, 0, 26 server-timing cdn-cache; desc=HIT, edge; dur=66 content-length 516 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:13 GMT x-frame-options SAMEORIGIN date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=422 expires Fri, 29 Jan 2021 06:24:12 GMT
GET H2	200	rss-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	461 B 919 B	306ms 222ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/rss-icon.svg?la=en&hash=76C4DAFD331DC675814191A66794A778D8C6DCF7 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash b7c9fd97a3a7165755766cd3ba55676f6505642b8c522d89d6f0ab0cabaaa8d7 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 907, 907, 907, 1088, 907 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 31, 1, 0, 26 server-timing cdn-cache; desc=HIT, edge; dur=165 content-length 305 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:16 GMT x-frame-options SAMEORIGIN date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=673 expires Fri, 29 Jan 2021 06:28:23 GMT
GET H2	200	twitter-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	1 KB 1 KB	314ms 229ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/twitter-icon.svg?la=en&hash=9A90D9F99ABE6454741BBAAF9C3FB6966624C92D Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash 52600b30637371871a7d5d50ba86cb9a29ad65d75a78824b4daba442c4eee113 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 816, 816, 816, 973, 816, 816, 816 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 31, 5, 5, 1, 0, 13 server-timing cdn-cache; desc=HIT, edge; dur=157 content-length 582 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:19 GMT x-frame-options SAMEORIGIN date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=356 expires Fri, 29 Jan 2021 06:23:06 GMT
GET H2	200	youtube-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	792 B 989 B	301ms 217ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/youtube-icon.svg?la=en&hash=CCCF647AFA78C8DB74D654DB9FEFBF0AC54F42D3 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash 0ce7b19357902318f5e2db207e64647d6a78d7f9f620ef55a8a07ad2f8e6d798 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 2693, 2693, 2693, 2693 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 31, 0, 13 server-timing cdn-cache; desc=HIT, edge; dur=131 content-length 426 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 16 May 2019 15:01:23 GMT x-frame-options SAMEORIGIN date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=489 expires Fri, 29 Jan 2021 06:25:19 GMT
GET H2	200	/ Show response news.sophos.com/_static/	140 KB 40 KB	6ms 6ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyVkMEOwiAMhl9IYBtG48H4KAZZ3ZgUCAWnby9mWeLBw0h66d/va5OKOTDtXQKXRBoBgQT5MHpyMBPrmvYoJipVIP8wwJ4d73hbAr4EfKKd2LRD+1hBwytFRdv5JeI5GVtvaYVBmcFVi0HF5CBWe4OqVr7ZKhmnbe6BlrcilgUsQrBvjsb9g0oLeIP+d75exsyCzYNxJNTDEEIS1+KKu49Y2Aue20NzkvtGSjl9AG1Byg4= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7a7dadc7ff2068d9772a91502491eefdd1a6affb4d31da24a90c15937dc2070d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-rq hhn2 102 126 3102 last-modified Tue, 08 Dec 2020 22:26:42 GMT server nginx age 1260270 vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 41205
GET H2	200	e-202104.js Show response stats.wp.com/	9 KB 3 KB	47ms 15ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202104.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT ams date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip server nginx etag W/"5c6340e3-350a" vary Accept-Encoding content-type application/javascript cache-control max-age=31536000 expires Mon, 17 Jan 2022 13:04:04 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	91 KB 35 KB	23ms 22ms	Script application/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c3f29f8d36265767daee6fbb5097ff97a51d9247e7464d0220a96a83b129769e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding br vary * cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35254 x-xss-protection 0 pragma no-cache server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	wp-emoji-release.min.js Show response news.sophos.com/wp-includes/js/	14 KB 5 KB	7ms 6ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 3685c3818240f5f390073c7d04f944a5cb5d848093224f3a7888034e8c050eb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-rq hhn2 102 126 3102 last-modified Tue, 08 Dec 2020 22:26:42 GMT server nginx age 4429281 etag W/"5fcffda2-37a6" vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4721 expires Sat, 29 Jan 2022 06:17:10 GMT
GET H2	200	footer.css news.sophos.com/wp-content/themes/sophosnews-2017/	3 KB 1015 B	6ms 6ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/footer.css Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 29e135bc96ba3ec4a643931a8ef458e48aa372894da5c635433993ea961ab7ae Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-rq hhn2 102 104 3087 last-modified Sat, 31 Oct 2020 08:56:19 GMT server nginx age 7337339 etag W/"5f9d26b3-a6e" vary Accept-Encoding x-cache hit content-type text/css cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 880 expires Sat, 29 Jan 2022 06:17:10 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f81f3b44c5da8f8b9b365294b2146763d666b9f445e1b2285466910d5361cec5 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	435 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 011ee00e2221fd2994156f01b85251391099270cc849857806d6a249481c90ff Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	342 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b0348edeb29dc1accfecb54a863c8597ea124c1ab9f1a38f3b9e12e953364a05 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	518 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1875cad468466b9b4ea2ebd196b8969f905ab31c20cd5e0a0c2da9b37fa12095 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c8fa9e46358747cc949be0709256687b7ac1f8fd295f0de4073b11a41c534b62 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	469 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04029edaf619462965453e8ac9cf74c584b1ef526c95f71185acc63a696b7f1c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	665 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f2792fa9c99f81eaf3035f2ba7634dd84f42526df8a1f31196912de7e55c815e Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	349 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3f510f8a21c09db2bb8f964b3e424fce6a77aea73ac791e9c0c6b8b238405366 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	515 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 633210530499824ad06b2b30a04a9ee18b4b8e2071620691a58c9a476dc728b9 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H2	200	sophos-news-ft-img-mtr_v1.png news.sophos.com/wp-content/uploads/2020/08/	27 KB 27 KB	8ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/08/sophos-news-ft-img-mtr_v1.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5572c863ab7c9fbc6f64ef41a39b12e7a4a24e3c298989ed9796e9e14f8925d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 109 139 443 last-modified Thu, 05 Nov 2020 10:48:34 GMT server nginx etag "a0a7f780337fa3d6" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 27584 expires Fri, 05 Nov 2021 10:48:34 GMT
GET H2	200	sophos-mtr-2.png news.sophos.com/wp-content/uploads/2020/09/	45 KB 46 KB	8ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/09/sophos-mtr-2.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6745f5377fb3204310b1686e12cf36eaded1a37d833e01bbc7b70d74006fa7b1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 109 27 443 last-modified Mon, 25 Jan 2021 21:59:20 GMT server nginx etag "bc7a2b633e615a2e" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 46442 expires Tue, 25 Jan 2022 21:59:20 GMT
GET H2	200	sophos-news-ft-img-mtr_v3.png news.sophos.com/wp-content/uploads/2020/08/	48 KB 48 KB	9ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/08/sophos-news-ft-img-mtr_v3.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7eb69c20bdfe9d883c00bc771f731f5841e0a62ba2c7a0b5d96300a9bf79832f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 109 30 443 last-modified Thu, 05 Nov 2020 08:08:10 GMT server nginx etag "f8f2bae8df859eec" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 49326 expires Fri, 05 Nov 2021 08:08:10 GMT
GET H2	200	SophosSans-Regular.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	24 KB 25 KB	7ms 5ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Regular.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c1da7a3d76f2fd71ba637d968b49556520ee94d72a5b60a5d21f34f5e4029ec4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT vary X-Mobile-Class, Accept-Encoding age 133 x-cache hit content-length 25020 x-rq hhn2 103 47 3099 last-modified Thu, 29 Oct 2020 17:01:28 GMT server nginx etag "5f9af568-61bc" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 29 Jan 2022 06:17:10 GMT
GET H2	200	SophosSans-Light.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	25 KB 25 KB	9ms 8ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 102 104 3107 last-modified Wed, 30 Dec 2020 14:58:53 GMT server nginx age 133 etag "5fec95ad-62e4" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 25316 expires Sat, 29 Jan 2022 06:17:10 GMT
GET H2	200	SophosSans-Medium.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	9ms 8ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 102 104 3107 last-modified Wed, 30 Dec 2020 14:58:53 GMT server nginx age 1487 etag "5fec95ad-67a4" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 26532 expires Sat, 29 Jan 2022 06:17:10 GMT
GET H2	200	SophosSans-Semibold.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	10ms 8ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888770 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 102 126 3102 last-modified Sun, 01 Nov 2020 13:44:25 GMT server nginx age 132 etag "5f9ebbb9-6828" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 26664 expires Sat, 29 Jan 2022 06:17:10 GMT
GET H2	200	Account-creds2.jpg news.sophos.com/wp-content/uploads/2021/01/	150 KB 150 KB	6ms 5ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/Account-creds2.jpg?resize=768,402 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5bdf8ed4732a6548d90627c662c8e43cb440cf7a1cabb72ef55dcef7f438be80 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 109 142 443 last-modified Tue, 26 Jan 2021 13:44:17 GMT server nginx etag "d199aecfabc81240" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 153258 expires Wed, 26 Jan 2022 13:44:17 GMT
GET H2	200	sophos-mtr-rapid-response-timeline-nefilim_v2-1.png news.sophos.com/wp-content/uploads/2021/01/	50 KB 50 KB	8ms 7ms	Image image/png	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/sophos-mtr-rapid-response-timeline-nefilim_v2-1.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 8b65669f1a8c624b7ff0a0701a9710eb9064a91d7d108663597c53fb95a04d08 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT x-rq hhn2 109 140 443 last-modified Mon, 25 Jan 2021 15:22:58 GMT server nginx etag "ade44df62b1a57bf" strict-transport-security max-age=31536000 x-cache HIT content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 51187 expires Wed, 26 Jan 2022 13:44:16 GMT
GET H2	200	dc.js Show response stats.g.doubleclick.net/	45 KB 17 KB	16ms 15ms	Script text/javascript	2a00:1450:400c:c00::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/dc.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVkMEOwiAMhl9IYBtG48H4KAZZ3ZgUCAWnby9mWeLBw0h66d/va5OKOTDtXQKXRBoBgQT5MHpyMBPrmvYoJipVIP8wwJ4d73hbAr4EfKKd2LRD+1hBwytFRdv5JeI5GVtvaYVBmcFVi0HF5CBWe4OqVr7ZKhmnbe6BlrcilgUsQrBvjsb9g0oLeIP+d75exsyCzYNxJNTDEEIS1+KKu49Y2Aue20NzkvtGSjl9AG1Byg4= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 6536 date Fri, 29 Jan 2021 04:28:14 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17093 expires Fri, 29 Jan 2021 06:28:14 GMT
GET H/1.1	200 OK	elqCfg.min.js Show response img03.en25.com/i/	6 KB 3 KB	71ms 25ms	Script application/x-javascript	104.108.55.181 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img03.en25.com/i/elqCfg.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVkMEOwiAMhl9IYBtG48H4KAZZ3ZgUCAWnby9mWeLBw0h66d/va5OKOTDtXQKXRBoBgQT5MHpyMBPrmvYoJipVIP8wwJ4d73hbAr4EfKKd2LRD+1hBwytFRdv5JeI5GVtvaYVBmcFVi0HF5CBWe4OqVr7ZKhmnbe6BlrcilgUsQrBvjsb9g0oLeIP+d75exsyCzYNxJNTDEEIS1+KKu49Y2Aue20NzkvtGSjl9AG1Byg4= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.181 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-181.deploy.static.akamaitechnologies.com Software / Resource Hash 6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 2115 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Fri, 16 Oct 2020 14:38:37 GMT Date Fri, 29 Jan 2021 06:17:10 GMT Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-cache, no-store ETag "ee5a418caa3d61:0" Accept-Ranges bytes Expires Fri, 29 Jan 2021 06:17:10 GMT
GET H2	200	g.gif pixel.wp.com/	50 B 92 B	16ms 15ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&j=1%3A9.3.1&blog=166161023&post=72133&tz=-5&srv=news.sophos.com&host=news.sophos.com&ref=&fcp=627&rand=0.8460340768227794 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1886160334&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=844060608.1611901031&jid=1727076947&_v=5.7.2dc&z=1886160334 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=844060608.1611901031&jid=1727076947&_v=5.7.2dc&z=1886160334&slf_rd=1&random=2174471769	42 B 107 B	16ms 16ms	Image image/gif	2a00:1450:4001:80e::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=844060608.1611901031&jid=1727076947&_v=5.7.2dc&z=1886160334&slf_rd=1&random=2174471769 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 29 Jan 2021 06:17:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Fri, 29 Jan 2021 06:17:10 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=844060608.1611901031&jid=1727076947&_v=5.7.2dc&z=1886160334&slf_rd=1&random=2174471769 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	__utm.gif stats.g.doubleclick.net/r/	35 B 412 B	76ms 37ms	Image image/gif	2a00:1450:400c:c00::9c GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=926169700&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&utmhid=1911250402&utmr=-&utmp=%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&utmht=1611901030619&utmac=UA-737537-53&utmcc=__utma%3D204943247.1308216970.1611901031.1611901031.1611901031.1%3B%2B__utmz%3D204943247.1611901031.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1170134762&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Fri, 29 Jan 2021 06:17:10 GMT content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	97 KB 38 KB	15ms 15ms	Script application/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-743773256 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9e28da38d10d6ec726ed26585e88e35fd637c22a23f8f7ddb18cd26425140b51 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 38889 x-xss-protection 0 last-modified Fri, 29 Jan 2021 06:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 29 Jan 2021 06:17:10 GMT
GET H2	200	bat.js Show response bat.bing.com/	27 KB 9 KB	46ms 29ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip last-modified Tue, 20 Oct 2020 22:19:32 GMT x-msedge-ref Ref A: F5ACC2FD9E1F49AEA733AB55AC85A970 Ref B: FRAEDGE1318 Ref C: 2021-01-29T06:17:10Z etag "0b27f152fa7d61:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 8454
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	91 KB 24 KB	22ms 5ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23762 x-fb-rlafr 0 pragma public x-fb-debug Qwvd1IKTzKo9aBDv0eUq9sGh9DhhiSLeEFZ2UcKUfSh1ykOUUs09AMU9Fj45NIul9bW/PFxR6f4ouJjej7hpew== x-fb-trip-id 2052514463 x-frame-options DENY date Fri, 29 Jan 2021 06:17:10 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	31ms 10ms	Script application/x-javascript	2a02:26f0:10c:582::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 29 Jan 2021 06:17:10 GMT Content-Encoding gzip Last-Modified Mon, 04 Jan 2021 22:14:03 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=74471 Connection keep-alive Accept-Ranges bytes Content-Length 1855
GET H2	200	WuEFNglz.min.js Show response scripts.demandbase.com/	60 KB 16 KB	114ms 29ms	Script application/javascript	13.224.194.13 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/WuEFNglz.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.194.13 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-13.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 058b79d96bbf2a9f0558efaff44f70126cb2f5e73d8758d0f9b86ea1672d642e Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id HYpIheFF8jWD1XlX2mxVztFQbf3DVt6K content-encoding gzip last-modified Wed, 20 Jan 2021 13:33:48 GMT server AmazonS3 age 259 etag W/"94d0160d80ec0ee1a85a3b9515452619" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront) cache-control public, max-age=3600 date Fri, 29 Jan 2021 06:12:52 GMT x-amz-cf-pop FRA2-C1 x-amz-cf-id 12kN0syTY92CwXsrpoUasUSaTg2G7rCWqDQGUu7WgGL7wkTpVJpJSA==
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	70ms 22ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT via 1.1 varnish last-modified Fri, 04 Dec 2020 00:21:46 GMT age 22710 etag "cbc512946c8abb461c6215ed5b454e5f+gzip" vary Accept-Encoding,Host x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-encoding gzip cache-control no-cache accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 1957 x-timer S1611901031.693938,VS0,VE0 x-served-by cache-fra19128-FRA
GET H2	200	qevents.js Show response a.quora.com/	39 KB 14 KB	73ms 22ms	Script text/plain	151.101.13.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://a.quora.com/qevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id s3LlaOWABX1LUjiLldBNr49lVAylKDRo content-encoding gzip etag "f32ebb1e93a72c0a57add6d07f688510" age 6176 x-cache HIT, HIT content-length 13681 x-amz-id-2 7cMUN4BxseabDWi+SLmObMFBYpcL1q5N5k38XqnDaTy829njk+rWX/DGp9DkvWKU8AEDzhpCbgk= x-served-by cache-bwi5146-BWI, cache-fra19135-FRA last-modified Fri, 25 Oct 2019 19:28:38 GMT server AmazonS3 x-amz-meta-s3cmd-attrs atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou x-timer S1611901031.697908,VS0,VE0 date Fri, 29 Jan 2021 06:17:10 GMT vary Accept-Encoding x-amz-request-id 6029B55864441FD6 via 1.1 varnish, 1.1 varnish cache-control max-age=7200 accept-ranges bytes content-type text/plain x-cache-hits 1, 591
GET H/1.1	200 OK	events.js Show response tags.srv.stackadapt.com/	13 KB 5 KB	443ms 123ms	Script text/javascript	52.205.8.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/events.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-205-8-225.compute-1.amazonaws.com Software / Resource Hash c53fdbaddaff19b7b3926c8e99c839a7e43cdeb9265fb178dbbc2c22e51edd39 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 29 Jan 2021 06:17:11 GMT Content-Encoding gzip Cache-Control max-age=30 Content-Length 4297 Connection keep-alive Content-Type text/javascript
GET H/1.1	200 OK	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	5 KB 6 KB	97ms 24ms	Script application/x-javascript	205.185.216.10 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS map2.hwcdn.net Software / Resource Hash 20b11d2c0012e286c38350d6c9b2ba03341667d9bc7226bf526fb47e89668fd9 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 29 Jan 2021 06:17:10 GMT Connection Keep-Alive Last-Modified Fri, 18 Dec 2020 19:31:32 GMT x-amz-request-id tx0000000000000ae3cc243-00600ec13e-2cef14a-sfo2a ETag "23752d527a82df9be63eb97fe04bceb3" Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1611901030.dop240.lo4.t,1611901030.cds224.lo4.shn,1611901030.dop240.lo4.t,1611901030.cds097.lo4.c Content-Type application/x-javascript Cache-Control max-age=283480 x-rgw-object-type Normal Strict-Transport-Security max-age=15552000; includeSubDomains; preload Accept-Ranges bytes Content-Length 5105
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	30 KB 13 KB	99ms 47ms	Script text/javascript	142.250.74.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.74.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s02-in-f2.1e100.net Software cafe / Resource Hash 34fcae3cf94e02d46c230a5b7dd3827d612587164e048dcfe146518da1cb4ab0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 12189 x-xss-protection 0 server cafe etag 8926089356025331971 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 29 Jan 2021 06:17:10 GMT
GET H2	200	334990480506518 Show response connect.facebook.net/signals/config/	241 KB 70 KB	7ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/334990480506518?v=2.9.33&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f9b3c3cf0d586f12051411da0bc10e6c4c0a747db04588c9adcab62ca0b4325c Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 70639 x-fb-rlafr 0 pragma public x-fb-debug DMM9M/9XNx/4mgYHmFI9/0vgFPe0o7DQLbR+cD1/dxWsNd3s6i27j6zaB1wG4YsjG3fqNHQJKTYc9XgrthFutQ== x-fb-trip-id 2052514463 x-frame-options DENY cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Fri, 29 Jan 2021 06:17:10 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-content-id 1346959260 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611901030669&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1611901030669%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611901030669&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&liSync=...	0 261 B	181ms 180ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611901030669&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&liSync=true Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:11 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 0 x-li-uuid Ry6YlnKfXhaQXYlmDisAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-content-type-options nosniff linkedin-action 1 content-length 0 x-li-uuid ac6gj3KfXhbg6bYpfSsAAA== pragma no-cache x-li-pop afd-prod-lor1 x-msedge-ref Ref A: AA0AC07FEE364DC78E9C3CF1711C3196 Ref B: FRAEDGE1507 Ref C: 2021-01-29T06:17:10Z x-frame-options sameorigin date Fri, 29 Jan 2021 06:17:10 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=31536000 x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611901030669&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&liSync=true cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 148 B	30ms 30ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=5a924979-853e-488c-b91b-1a0b3e7ad9f1&sid=9ef995a061f911ebb1efcd62e4ffe567&vid=9ef98d1061f911eb8bbca7c6c8b42c49&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&r=&lt=681&evt=pageLoad&msclkid=N&sv=1&rn=584577 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Fri, 29 Jan 2021 06:17:10 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 5CF9F42437A847E6BF58F0ED3DAD8716 Ref B: FRAEDGE1318 Ref C: 2021-01-29T06:17:10Z expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 410 B	18ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&rl=&if=false&ts=1611901030696&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1611901030695.2071410576&it=1611901030666&coo=false&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 29 Jan 2021 06:17:10 GMT
GET H2	200	adsct t.co/i/	43 B 449 B	185ms 140ms	Image image/gif	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 119 pragma no-cache last-modified Fri, 29 Jan 2021 06:17:10 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 16bc8f0dd7766b60142e033319f3b0f5 x-transaction 0077517500c3b449 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	pixel q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/	43 B 420 B	427ms 107ms	Image image/gif	3.225.115.141 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&tag=ViewContent&ts=1611901030716 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.225.115.141 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-225-115-141.compute-1.amazonaws.com Software nginx / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 29 Jan 2021 06:17:11 GMT Server nginx Connection keep-alive Content-Length 43 Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Q-Stat ,0b771f427fcc17f891db91a5b226533c,10.0.0.96,32776,185.212.171.67,,63163427421,1,1611901031.105,0.002,,.,0,0,0.000,0.000,-,0,0,197,84,42,10,26847,,,,,,-, Content-Type image/gif
GET H2	200	ip.json Show response api.company-target.com/api/v2/	438 B 941 B	115ms 67ms	XHR application/json	143.204.93.38 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&page_title=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7 Requested by Host: scripts.demandbase.com URL: https://scripts.demandbase.com/WuEFNglz.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.93.38 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-93-38.fra50.r.cloudfront.net Software nginx / Resource Hash 61a2d2d9e72b541b52b029da2febf1203b443126b6cccbc4fa23a8718af52a3a Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT identification-source CENTRAL vary Accept-Encoding, Origin x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront request-id 3c7fb5fa-ecae-48eb-9f7e-3864e36f6eeb content-encoding gzip pragma no-cache access-control-allow-origin https://news.sophos.com server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id YFzJAo3cST2KROv94rtDMEQ867ZA4lNS97GHvwedGf0HXoG_Ia_3dg== expires Thu, 28 Jan 2021 06:17:10 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AAEvHU7AJ1EAABEvcHHRag https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEvHU7AJ1EAABEvcHHRag&verifyHash=7c9ecadf032a3076b0475fcf9ba15179e9de78df	26 B 408 B	127ms 127ms	Image image/gif	13.225.80.54 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEvHU7AJ1EAABEvcHHRag&verifyHash=7c9ecadf032a3076b0475fcf9ba15179e9de78df Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.225.80.54 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-54.fra2.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 29 Jan 2021 06:17:11 GMT Via 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id 35d78e3790e05a59 X-Amz-Cf-Id Cmr8mw8U55n08sAMsUe1MlBxR40WVOY78a-cwY4jKxJ40WXgURNhNA== Redirect headers Date Fri, 29 Jan 2021 06:17:11 GMT Via 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AAEvHU7AJ1EAABEvcHHRag&verifyHash=7c9ecadf032a3076b0475fcf9ba15179e9de78df Connection keep-alive trace-id 5b169fab890a5c5f Content-Length 0 X-Amz-Cf-Id aB39ZHkXDtDpuvNoyw-SigE79gOkTMtdlIOv-1MoW4CHps8USYWR4Q==
GET H2	451	464526.gif id.rlcdn.com/	0 66 B	55ms 21ms	Image text/plain	34.120.207.148 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://id.rlcdn.com/464526.gif Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.207.148 , United States, ASN15169 (GOOGLE, US), Reverse DNS 148.207.120.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:10 GMT via 1.1 google alt-svc clear content-length 0
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/	2 KB 1 KB	31ms 31ms	Script text/javascript	2a00:1450:4001:827::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1611901030791&cv=9&fst=1611901030791&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1k0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&tiba=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 98e7456c4f008e4218533603a2b3b9d7812b6eb4b177a2b225a551b65af55176 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 29 Jan 2021 06:17:10 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1099 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/743773256/	42 B 530 B	51ms 37ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/743773256/?random=1611901030791&cv=9&fst=1611900000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1k0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&tiba=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1670678158&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 29 Jan 2021 06:17:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/743773256/	42 B 530 B	54ms 40ms	Image image/gif	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/743773256/?random=1611901030791&cv=9&fst=1611900000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1k0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&tiba=Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1670678158&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 29 Jan 2021 06:17:10 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	sa.css tags.srv.stackadapt.com/	83 B 310 B	119ms 118ms	Stylesheet text/css	52.205.8.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.css Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-205-8-225.compute-1.amazonaws.com Software / Resource Hash 34ef55554d73540815abb072133dccdc4e5ff6d62e8470317258c315f67874ea Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 29 Jan 2021 06:17:11 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 83 Content-Type text/css
GET H/1.1	200 OK	sa.jpeg Show response tags.srv.stackadapt.com/	0 881 B	3808ms 106ms	Fetch image/jpeg	52.205.8.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.jpeg Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-205-8-225.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 29 Jan 2021 06:17:14 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 651 Content-Type image/jpeg
GET H2	200	/ www.facebook.com/tr/	44 B 147 B	6ms 5ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&rl=&if=false&ts=1611901031199&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22Nefilim%20Ransomware%20Attack%20Uses%20%E2%80%9CGhost%E2%80%9D%20Credentials%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F%22%2C%22og%3Adescription%22%3A%22Keeping%20close%20tabs%20on%20the%20account%20credentials%20in%20your%20organization%20should%20always%20be%20a%20top%20priority%2C%20as%20a%20Sophos%20Rapid%20Response%20customer%20recently%20learned.%20Sophos%20Rapid%20Response%20is%20a%2024%2F7%20service%20tha%E2%80%A6%22%2C%22article%3Apublished_time%22%3A%222021-01-26T13%3A30%3A41%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-01-26T20%3A04%3A57%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F01%2FAccount-creds2.jpg%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F01%2FAccount-creds2.jpg%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22335%22%2C%22og%3Aimage%3Aalt%22%3A%22Ghost%20credentials%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1611901030695.2071410576&it=1611901030666&coo=false&es=automatic&tm=3&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:11 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 29 Jan 2021 06:17:11 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 651 B	3175ms 140ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 29 Jan 2021 06:17:14 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 112 pragma no-cache last-modified Fri, 29 Jan 2021 06:17:14 GMT server tsa_f x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 1f702dbd80143841be0a1ace00406785 x-transaction 004fccf2004fe9b7 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	saq_pxl Show response tags.srv.stackadapt.com/	94 B 397 B	1780ms 1780ms	XHR text/plain	52.205.8.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&host=https://news.sophos.com Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-205-8-225.compute-1.amazonaws.com Software / Resource Hash 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 29 Jan 2021 06:17:13 GMT Access-Control-Allow-Methods GET Content-Type text/plain; charset=utf-8 Access-Control-Allow-Origin https://news.sophos.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 94
GET H/1.1	204 No Content	js_tracking Show response tags.srv.stackadapt.com/	0 250 B	1886ms 106ms	XHR text/plain	52.205.8.225 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/js_tracking?url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F26%2Fnefilim-ransomware-attack-uses-ghost-credentials%2F&uid=uxMvfKEouJZfJzsjwRVn_Q&host=https://news.sophos.com Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.205.8.225 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-205-8-225.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin https://news.sophos.com Date Fri, 29 Jan 2021 06:17:13 GMT Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Access-Control-Allow-Methods GET