www.darkreading.com Open in urlscan Pro
104.17.119.99 Public Scan

URL: https://www.networkcomputing.com/
Title: Network Computing

URL: https://ng.techweb.com/authds/gateway?gateway=true&return=https%3A%2F%2Fwww%2Edarkreading%2Ecom%2Fattacks%2Dbreaches%2Fsynack%2Dransomware%2Dgets%2Ddangerous%2Ddoppleganging%2Dfeature%2Fd%2Fd%2Did%2F1331736%3FngAction%3Dregister
Title: Register

URL: http://createyournextcustomer.techweb.com/contact-us/
Title: Advertise

URL: http://reports.informationweek.com/search?search=security
Title: Reports

URL: http://www.informationweek.com/whitepaper/Security
Title: White Papers

URL: https://www.facebook.com/darkreadingcom
Title: Facebook

URL: http://twitter.com/DarkReading
Title: Twitter

URL: http://www.linkedin.com/groups?home=&gid=3193466&trk=anet_ug_hm
Title: LinkedIn

URL: https://plus.google.com/+darkreading
Title: Google+

URL: https://www.interop.com/?_mc=we_x_dr_le_tsnr_intplv_x_x-drheader

URL: http://www.informationweek.com/whitepaper
Title: Tech Library

URL: https://twitter.com/jaivijayan

URL: https://www.linkedin.com/in/jaivijayan

URL: https://blog.ensilo.com/process-doppelganging-frequently-asked-questions
Title: technique

URL: http://teads.tv/inread-outstream/
Title: inRead invented by Teads

URL: https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/
Title: their advisory

URL: https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssOhbt4HAHWye_k3nYoW5kALvuOph-U96iV4dP9SD4-rTHh274_jKx2aFDo8dmtjZjSjGUnAwFlUHAwbka0l0FaA0CnAy27z0d-vp78VS36MFoS3oZUZ8bulTChSoF_nvVWWKfs_p_e11wecBrIK0-t7jV1kd8tmv7METJbfBD5TjK0miBRuGVn76QR0UGJhvJJT-eXmYjiT-CxNnWtSCwnI4pXG17us7I7vT7qjDQ3HYqMF_EmjNb8LYO3vndbpLr5DxViqXzY%2526sai%253DAMfl-YQZ9wtB7-VpKjb0_gyD3De0WlB3_dCqt4rdmXh4L6Hlk0zx6zJEbHAa8m2lfLY2Df-nwGHXC_pCVPEDO56j9lLsCRkBXsOGaUTHcIZ8%2526sig%253DCg0ArKJSzDLiaLuPdTexEAE%2526urlfix%253D1%2526adurl%253Dhttps://www.darkreading.com/stopping-bots-and-credential-stuffing-a-smarter-strategy/v/d-id/1331578

URL: https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstnzez2gVeelKFP6-SDz8aXZk_KUMCp8e6jDTGgJbyQQFPiNdeOdA6B0JeFAsPOVnXBoZdczjvUhTthOQTzj0M_mVY3Iahdtt53StquXABHPRWq23ipOmK0-wp40urrfXYpe6DDY6Nxj2AYr2filRlrcNpcbZHEdOvONCK744XDf36AOfnKHUAd92TY_xepD-IaxpE0U_X_gROo43vI0rx3jLYRSt73_jGp3frkc485kA_gl4LPGuFOgiwyzWAqBnPZe18KaR1i%2526sai%253DAMfl-YSQ22VQpGVJzGVZ1_VJrNNrOkGSzqZVAiSsOjOY6SCmmP0jOLaWydZUk90QNv6yxaNRNuj-a24pmDnKnfUffjrpG1SOOv6Y54gwqcsv%2526sig%253DCg0ArKJSzLVjLHrnoYtyEAE%2526urlfix%253D1%2526adurl%253Dhttps://www.darkreading.com/practically-applying-threat-intelligence-to-your-business/v/d-id/1331580
Title: Practically Applying Threat Intelligence to Your Business

URL: https://webinar.darkreading.com/3483?keycode=sbx&cid=smartbox_techweb_webcast_8.500000829
Title: Migrating On-Premises Security Controls to the Cloud

URL: https://crashcourse.darkreading.com/3223?keycode=sbx&cid=smartbox_techweb_webcast_8.500000826
Title: The Impact of a Data Breach

URL: http://www.informationweek.com/whitepaper/security-monitoring/security-management-and-analytics/five-phishing-predictions/397003?cid=smartbox_techweb_whitepaper_14.500003242
Title: 5 Phishing Predictions

URL: http://www.informationweek.com/whitepaper/security-management-and-analytics/risk-management/forrester%E2%80%99s-best-practices-for-mitigating-insider-threats-/396423?cid=smartbox_techweb_whitepaper_14.500003212
Title: Forrester's Best Practices for Mitigating Insider Threats

URL: http://www.informationweek.com/whitepaper/cybersecurity/risk-management-security/[strategic-security-report]-navigating-the-threat-intelligence-maze/393933?cid=smartbox_techweb_analytics_7.300005741
Title: [Dark Reading Report] Navigating the Threat Intelligence Maze

URL: http://www.informationweek.com/whitepaper/cybersecurity/security-monitoring/[strategic-security-report]-how-enterprises-are-attacking-the-cybersecurity-challenge/390403?cid=smartbox_techweb_analytics_7.300005733
Title: How Enterprises Are Attacking the IT Security Problem

URL: http://reports.informationweek.com/search?search=security/
Title: More Reports

URL: https://webinar.darkreading.com/3534?keycode=sbx&cid=smartbox_techweb_webcast_8.500000827
Title: Emerging Threats: Protect Your Organizations Digital Footprint

URL: https://webinar.darkreading.com/3587?keycode=sbx&cid=smartbox_techweb_webcast_8.500000824
Title: Strategy Session: Coping with the IT Security Skill Shortage

URL: http://www.informationweek.com/whitepaper/big-data/big-data-analytics/virtual-support-agent-evaluation/396683?cid=smartbox_techweb_whitepaper_14.500003236
Title: Virtual Support Agent Evaluation

URL: http://www.informationweek.com/whitepaper/applications/network-and-systems-management/raritan%E2%80%99s-px-intelligent-rack-pdus/396843?cid=smartbox_techweb_whitepaper_14.500003231
Title: Raritan's PX Intelligent Rack PDUs

URL: http://www.informationweek.com/whitepaper/network-and-systems-management/storage/digital-workplace/396773?token=24ca982ef571180def673f17b44affc8&cid=smartbox_techweb_whitepaper_14.500003223
Title: Digital Workplace

URL: http://www.informationweek.com/whitepaper/cybersecurity/risk-management-security/[strategic-security-report]-navigating-the-threat-intelligence-maze/393933?cid=mp_rptbx&_mc=mp_rptbx

URL: http://www.informationweek.com/whitepaper/security-monitoring/cybersecurity/the-state-of-ransomware/392413?cid=mp_rptbx&_mc=mp_rptbx
Title: The State of Ransomware

URL: http://www.informationweek.com/whitepaper/security-monitoring/cybersecurity/the-state-of-ransomware/392413?cid=mp_rptbx&_mc=mp_rptbx#msgs
Title: 0 comments

URL: http://www.informationweek.com/whitepaper/cybersecurity/security-monitoring/%5bstrategic-security-report%5d-how-enterprises-are-attacking-the-cybersecurity-challenge/390403?cid=mp_rptbx&_mc=mp_rptbx
Title: [Strategic Security Report] How Enterprises Are Attacking the IT Security Problem

URL: http://www.informationweek.com/whitepaper/network-and-perimeter-security/security-management-and-analytics/how-data-breaches-affect-the-enterprise/390563?cid=mp_rptbx&_mc=mp_rptbx
Title: The Impact of a Security Breach 2017

URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2018-10164
Title: CVE-2018-10164

URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2018-10165
Title: CVE-2018-10165

URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2018-10166
Title: CVE-2018-10166

URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2018-10167
Title: CVE-2018-10167

URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2018-10168
Title: CVE-2018-10168

URL: http://www.wrightsreprints.com/reprints/?magid=2202
Title: Reprints

URL: http://www.ubmtechweb.com/

URL: http://www.blackhat.com/
Title: Black Hat

URL: http://contentmarketinginstitute.com/
Title: Content Marketing Institute

URL: http://www.contentmarketingworld.com/
Title: Content Marketing World

URL: http://www.enterpriseconnect.com/
Title: Enterprise Connect

URL: http://www.gdconf.com/
Title: GDC

URL: http://www.gamasutra.com/
Title: Gamasutra

URL: http://www.thinkhdi.com/
Title: HDI

URL: http://www.icmi.com/
Title: ICMI

URL: http://insecurity.com/
Title: INsecurity

URL: http://www.interop.com/
Title: Interop ITX

URL: http://www.networkcomputing.com/
Title: Network Computing

URL: http://www.nojitter.com/
Title: No Jitter

URL: http://www.smworld.com/
Title: Service Management World

URL: http://www.xrdconf.com/
Title: XRDC

URL: http://tech.ubm.com/community-brands/content-marketing-2/
Title: Content Marketing

URL: http://tech.ubm.com/community-brands/enterprise-it/
Title: Enterprise IT

URL: http://tech.ubm.com/community-brands/enterprise-communications/
Title: Enterprise Communications

URL: http://tech.ubm.com/community-brands/game-and-app-developers/
Title: Game Development

URL: http://tech.ubm.com/community-brands/information-security/
Title: Information Security

URL: http://tech.ubm.com/community-brands/technical-service-and-support/
Title: IT Services & Support

URL: http://events.ubm.com/?company=10
Title: Event Calendar

URL: http://createyournextcustomer.techweb.com/
Title: Tech Marketing

URL: http://tech.ubm.com/contact-us/
Title: Contact Us

URL: http://wrightsmedia.com/sites/ubm/index.cfm
Title: Licensing

URL: http://legal.us.ubm.com/terms-of-service/
Title: Terms of Service

URL: http://legal.us.ubm.com/privacy-policy/
Title: Privacy Statement

URL: http://reg.ubmamevents.com/UBMLegalEntities
Title: Legal Entities

URL: http://twitter.com/share/?text=&url=%3Ff%5Fsrc%3Dthissite%5Ftweetlink
Title: Tweet This

fra15s29-in-f10.1e100.net

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/XK6tlvz48H Page URL
http://bit.ly/2Irsscy HTTP 301
http://www.limber.click/594201 HTTP 302
https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67

https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F314&f=%2Fdarkreading%2Fsection%2F314%2F1331736&rndserial=18480 HTTP 302
https://img.deusm.com/images/spacer.gif

Request Chain 72

https://ubmtech.d3.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731 HTTP 302
https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1

Request Chain 73

https://cm.everesttech.net/cm/dd?d_uuid=73326496627335041393145404121337395503 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=WvQL8gAAAr49KxKk

Request Chain 74

https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1 HTTP 302
https://ubmtech.d3.sc.omtrdc.net/id?AQB=1&vmr=true&&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1

Request Chain 84

https://rudy.adsnative.com/cm.gif HTTP 302
https://bh.contextweb.com/bh/rtset?do=add&pid=558079&ev=9999&rurl=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fdspid%3D159402804%26buid%3D%25%25VGUID%25%25 HTTP 302
https://rudy.adsnative.com/cm.gif?dspid=159402804&buid=7qXBPh65TJWu&ev=9999&pid=558079&do=add HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fdspid%3D823634934%26buid%3D%23PM_USER_ID HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fdspid%3D823634934%26buid%3D%23PM_USER_ID&rdf=1 HTTP 302
https://rudy.adsnative.com/cm.gif?dspid=823634934&buid=D4598CB7-FD76-4E8D-8F75-8DDB20753BFB HTTP 302
https://sync.srv.stackadapt.com/sync?nid=46 HTTP 302
https://rudy.adsnative.com/cm.gif?dspid=1038693605&buid=0-69f06723-48a5-48a0-754c-fd76c7fb1608$ip$148.251.45.254 HTTP 302
https://srv.stackadapt.com/sync?nid=5 HTTP 302
https://rudy.adsnative.com/cm.gif?dspid=1416370744&buid=0-69f06723-48a5-48a0-754c-fd76c7fb1608$ip$148.251.45.254 HTTP 302
https://sync.outbrain.com/uidsyncpixel?url=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fbuid%3D%7BUUID%7D%26dspid%3D349348236&puuid=fb9c4d8f-e1d2-45ae-8249-a21a4574f911&dspid=349348236 HTTP 302
https://rudy.adsnative.com/cm.gif?buid=fb9c4d8f-e1d2-45ae-8249-a21a4574f911&dspid=349348236

Request Chain 97

https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1525943282324&ns_c=windows-1252&cv=3.1&c8=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&c9=https%3A%2F%2Ft.co%2FXK6tlvz48H HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1525943282324&ns_c=windows-1252&cv=3.1&c8=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&c9=https%3A%2F%2Ft.co%2FXK6tlvz48H

Request Chain 182

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=823 HTTP 302
https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=823&elqCookie=1

Request Chain 184

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled HTTP 302
https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled&elqCookie=1

Request Chain 254

https://d.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG?pv=9861017202.474165&cookie=&adroll_s_ref=https%3A//t.co/XK6tlvz48H&keyw=&name=darkreading_attacks_breaches&arrfrr=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F HTTP 302
https://s.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/DARDKNAFP5HS5ABHGM36J3.js

Request Chain 255

https://d.adroll.com/cm/aol/out HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&_origin=1 HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&_origin=1&verify=true

Request Chain 256

https://d.adroll.com/cm/index/out HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expiration=1557479285 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expiration=1557479285&C=1

Request Chain 257

https://d.adroll.com/cm/n/out HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expires=365 HTTP 307
https://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=194538&nid=3644&put=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expires=365

Request Chain 258

https://d.adroll.com/cm/pubmatic/out HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA

Request Chain 259

https://d.adroll.com/cm/taboola/out HTTP 302
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA

Request Chain 260

https://d.adroll.com/cm/r/out?advertisable=TQSV74R4GVCSJITSZC2MCP HTTP 302
https://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=https%3A%2F%2Fads.yahoo.com%2Fcms%2Fv1%3Fesig%3D1~bf4e7dc4546a90c08591652d78a230d3f2ef5733%26nwid%3D10001032567%26sigv%3D1

Request Chain 261

https://d.adroll.com/cm/b/out?advertisable=TQSV74R4GVCSJITSZC2MCP HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA HTTP 302
https://t.visx.net/sync?tp_id=1&tp_uid=16f9eb8b-94aa-4430-9be9-c8ce4c335056&ssp_custom_data= HTTP 302
https://t.visx.net/ul_cb/sync?tp_id=1&tp_uid=16f9eb8b-94aa-4430-9be9-c8ce4c335056&ssp_custom_data=

Request Chain 262

https://d.adroll.com/cm/x/out?advertisable=TQSV74R4GVCSJITSZC2MCP HTTP 302
https://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid(%27ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA%27)

Request Chain 263

https://d.adroll.com/cm/l/out?advertisable=TQSV74R4GVCSJITSZC2MCP HTTP 302
https://idsync.rlcdn.com/377928.gif?partner_uid=dd62945797fee66803bc6260f66d18f0 HTTP 302
https://idsync.rlcdn.com/377928.gif?partner_uid=dd62945797fee66803bc6260f66d18f0&redirect=1

Request Chain 264

https://d.adroll.com/cm/o/out?advertisable=TQSV74R4GVCSJITSZC2MCP HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=dd62945797fee66803bc6260f66d18f0 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=dd62945797fee66803bc6260f66d18f0

Request Chain 265

https://d.adroll.com/cm/g/out?advertisable=TQSV74R4GVCSJITSZC2MCP&google_nid=adroll2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=3WKUV5f-5mgDvGJg9m0Y8A&google_ula=1535926 HTTP 302
https://d.adroll.com/cm/g/in?google_ula=1535926,0

Request Chain 266

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

Request Chain 267

https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=5af40bf4c6fd45000130f864 HTTP 302
https://polo-v1.feathr.co/v1/analytics/match?f_id=5af40bf4c6fd45000130f864&ttd_id=756af128-a6db-42f6-a470-67ca427c87c6

273 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 XK6tlvz48H Show response
t.co/ 257 B
444 B 146ms
146ms Document
text/html 104.244.42.133
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/XK6tlvz48H

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

af75137873a0189ee2e8f32f19a71d5e49f70761f3f314d19caafc74b88b263e

Security Headers

Name	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /XK6tlvz48H
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E

Response headers

status: 200
cache-control: private,max-age=300
content-encoding: gzip
content-length: 192
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Thu, 10 May 2018 09:07:59 GMT
expires: Thu, 10 May 2018 09:12:59 GMT
referrer-policy: unsafe-url
server: tsa_o
set-cookie: muc=cf7e4a97-85f7-4998-a971-314e74e70105; Expires=Sat, 09 May 2020 09:07:59 UTC; Domain=t.co
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: e83fd70464a5652cdec4920f43c878e1
x-response-time: 140
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report

GET
H2

200

Primary Request 1331736 Show response
www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/
Redirect Chain

http://bit.ly/2Irsscy
http://www.limber.click/594201
https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

136 KB
25 KB

775ms
752ms

Document
text/html

104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Requested by

Host: t.co
URL: https://t.co/XK6tlvz48H

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

e62c5437ee23b01252961285d71da1d385ac11e1d8dec4de22220ec756a76028

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.darkreading.com
:scheme: https
:path: /attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://t.co/XK6tlvz48H
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://t.co/XK6tlvz48H

Response headers

status: 200
date: Thu, 10 May 2018 09:08:00 GMT
content-type: text/html
set-cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; expires=Fri, 10-May-19 09:07:59 GMT; path=/; domain=.darkreading.com; HttpOnly darkreading_lastvisit=5/10/2018 5:08:00 AM; expires=Tue, 10-May-2033 09:08:0 GMT; path=/; HttpOnly darkreading_lastvisit=5/10/2018 5:08:00 AM; expires=Tue, 10-May-2033 09:08:0 GMT; path=/; HttpOnly cplChannelTagID=; path=/ darkreading%2Dmeter=1331736; expires=Fri, 11-May-2018 04:00:00 GMT; path=/ darkreading%5Fvisits=2; expires=Tue, 10-May-2033 04:00:00 GMT; path=/
vary: Accept-Encoding
cache-control: private
x-pingback: http://www.staging.new.informationweek.com/xmlrpc.asp
x-powered-by: ASP.NET
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 418b423b1ab496c4-FRA
content-encoding: gzip

Redirect headers

Server: Cowboy
Connection: keep-alive
X-Frame-Options: ALLOW-FROM https://lbractorapp.herokuapp.com
Location: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Vary: Accept
Content-Type: text/html; charset=utf-8
Content-Length: 274
Date: Thu, 10 May 2018 09:07:59 GMT
Via: 1.1 vegur

GET
S 200 css
fonts.googleapis.com/ 250 B
305 B 18ms
10ms Stylesheet
text/css 172.217.18.170
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab:700

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.18.170 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

67ed54dabf4f333e843cbd69666703873970d94c34b37852654dec62a80ea628

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:00 GMT

GET
S 200 darkreading.css
twimgs.com/nojitter/css/ 17 KB
4 KB 55ms
10ms Stylesheet
text/css 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/darkreading.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 09:38:14 GMT
server: cloudflare
etag: "45f8-54e22b7428d80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 418b4241fcb3271a-FRA
content-length: 3545
expires: Thu, 10 May 2018 13:08:00 GMT

GET
H2 200 pano-framework.css
www.darkreading.com/styles/ 124 KB
9 KB 27ms
18ms Stylesheet
text/css 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/styles/pano-framework.css?v1.26

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

268819e04d4f1da7b25f24454f9f28e172289c17bff9b635468babeeb1992892

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /styles/pano-framework.css?v1.26
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Fri, 09 Feb 2018 08:36:03 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"fbc9f7481a1d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 418b4241c82496c4-FRA
expires: Thu, 10 May 2018 11:08:00 GMT

GET
H2 200 styles.css
www.darkreading.com/styles/ 292 B
313 B 26ms
17ms Stylesheet
text/css 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/styles/styles.css?v7

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

a8fc74838ba253a4076b8eb46aeed79c10341380609dcfe11bed40d974d1fd10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /styles/styles.css?v7
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 03 Apr 2017 14:07:44 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"b08d92aa83acd21:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 418b4241c82596c4-FRA
expires: Thu, 10 May 2018 11:08:00 GMT

GET
S 200 dr_nativead.css
i.ubm-us.net/oas/nativead/css/ 2 KB
776 B 57ms
13ms Stylesheet
text/css 104.24.120.117
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/css/dr_nativead.css?v3
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.120.117 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13943a8cdc412f8769bb2c8f92651e7d0261f95b733838b60dff9b7ed5bb8ee5

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 25 May 2017 19:39:37 GMT
server: cloudflare
etag: W/"855-5505e6187f040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-bgj: minify
cf-ray: 418b4241fd6764c9-FRA
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 nativead.js Show response
i.ubm-us.net/oas/nativead/js/ 1 KB
878 B 54ms
11ms Script
application/javascript 104.24.120.117
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/js/nativead.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.120.117 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3212d4408746da36ede9752d50bf4faa41179e5d2ebd261a70933e3a6b2717b9

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 30 Jul 2015 14:31:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b4241fd6964c9-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
S 200 dr_nativead.js Show response
i.ubm-us.net/oas/nativead/js/ 8 KB
1 KB 56ms
13ms Script
application/javascript 104.24.120.117
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/js/dr_nativead.js?v3
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.120.117 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 06 Oct 2017 16:50:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-bgj: minify
cf-ray: 418b4241fd6a64c9-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
H2 200 respond.min.js Show response
www.darkreading.com/script/ 4 KB
2 KB 25ms
17ms Script
application/x-javascript 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/respond.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /script/respond.min.js
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 22 Sep 2014 21:04:30 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"03ccda8d6cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 418b4241c82896c4-FRA
expires: Thu, 10 May 2018 11:08:00 GMT

GET
H2 200 jquery.mobile.custom.min.js Show response
www.darkreading.com/script/ 8 KB
3 KB 26ms
18ms Script
application/x-javascript 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/jquery.mobile.custom.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /script/jquery.mobile.custom.min.js
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 22 Sep 2014 21:04:30 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"03ccda8d6cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 418b4241c82996c4-FRA
expires: Thu, 10 May 2018 11:08:00 GMT

GET
S 200 complete.js Show response
twimgs.com/nojitter/js/ 45 KB
9 KB 59ms
16ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/complete.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 06:04:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b4241fcb9271a-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
S 200 jquery-1.11.min.js Show response
twimgs.com/nojitter/js/ 94 KB
33 KB 59ms
17ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery-1.11.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 06:05:04 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b4241fcb8271a-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
S 200 darkreading.js Show response
twimgs.com/nojitter/darkreading/ 27 KB
4 KB 57ms
15ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/darkreading/darkreading.js?v9
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5a37d18a14fb428d01bfe23b0e28db9b7a189e886513a7098683cb01f0929ee

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 23 Apr 2018 13:44:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b4241fcba271a-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
S 200 VisitorAPI.js Show response
epromos.ubmcanon.com/ 45 KB
15 KB 66ms
22ms Script
text/javascript 104.24.5.82
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.5.82 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa92b44ae441805b86a9603ffea3890a8df348fb2269d716c557b6970c11e9f4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 24 Apr 2018 23:42:00 GMT
server: cloudflare
etag: W/"1010b6-b435-56aa0b35ea1a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 418b42420b439810-FRA
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 at.js Show response
epromos.ubmcanon.com/ 106 KB
33 KB 87ms
42ms Script
text/javascript 104.24.5.82
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://epromos.ubmcanon.com/at.js?ormzkk
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.5.82 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42eb48be2f9f6fc91fcda10af9802cb6aa0733e2dd007c224570ae6ece3dac33

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 12 Apr 2018 15:42:52 GMT
server: cloudflare
etag: W/"1000c4-1a7c1-569a89bca3df7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 418b42420b449810-FRA
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 jplayer.blue.monday.css
twimgs.com/nojitter/css/ 12 KB
3 KB 65ms
23ms Stylesheet
text/css 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/jplayer.blue.monday.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 07:28:28 GMT
server: cloudflare
etag: "2f89-54ec1d5e89f00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 418b4241fcb5271a-FRA
content-length: 3117
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 style.css
twimgs.com/nojitter/css/ 912 B
452 B 53ms
11ms Stylesheet
text/css 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/style.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 07:30:36 GMT
server: cloudflare
etag: W/"390-54ec1dd89bf00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 418b4241fcb4271a-FRA
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 jquery.jplayer.min.js Show response
twimgs.com/nojitter/js/ 48 KB
12 KB 64ms
23ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery.jplayer.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cddbf405266cd4b3e66229592e63666012dbceaaad02635af5da9d303bfd3ed1

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 11:20:55 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b4241fcbb271a-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
S 200 jquery.tablesorter.min.js Show response
twimgs.com/nojitter/js/ 16 KB
5 KB 65ms
23ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery.tablesorter.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b90279154254e108748dc80dd226eab336e2c320e4a40569952b46dc5d785536

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 11:21:05 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b4241fcbc271a-FRA
expires: Fri, 11 May 2018 09:08:00 GMT

GET
H/1.1 200
OK ubm-widget-style.css
dsimg.ubm-us.net/ubm-widget/css/ 29 KB
6 KB 604ms
110ms Stylesheet
text/css 192.155.48.22
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://dsimg.ubm-us.net/ubm-widget/css/ubm-widget-style.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 192.155.48.22 New Hyde Park, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS: dsimg.ubm-us.net
Software: Apache/2.4.6 (Red Hat Enterprise Linux) /
Resource Hash: 1e97210e22581e4b07521a644b8874bf38e72bf51fb77691c4394aecbac3081b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 Apr 2018 16:31:21 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux)
ETag: "7393-569952b4c0840"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 5898

GET
H/1.1 200
OK ubm-widget-min.js Show response
dsimg.ubm-us.net/ubm-widget/js/ 192 KB
192 KB 620ms
112ms Script
application/javascript 192.155.48.22
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 192.155.48.22 New Hyde Park, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS: dsimg.ubm-us.net
Software: Apache/2.4.6 (Red Hat Enterprise Linux) /
Resource Hash: ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:01 GMT
Last-Modified: Wed, 11 Apr 2018 17:29:33 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux)
ETag: "2fe99-56995fb6fbbe3"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 196249

GET
H2 200 ng_forms.js Show response
www.darkreading.com/script/ 31 KB
7 KB 18ms
14ms Script
application/x-javascript 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/ng_forms.js?v7.9

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

4a95b07ec54d49e694b07142995eea1a12d961ed430270d137b3c29cdb9cf3d6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /script/ng_forms.js?v7.9
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Thu, 12 Apr 2018 07:57:36 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"a888c4eb33d2d31:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 418b4241c82a96c4-FRA
expires: Thu, 10 May 2018 11:08:00 GMT

GET
S 200 widget-extra.css
twimgs.com/nojitter/css/ 443 B
352 B 49ms
11ms Stylesheet
text/css 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/widget-extra.css?v1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 13 Sep 2017 07:28:37 GMT
server: cloudflare
etag: W/"1bb-5590d1ba81340"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 418b4241fcb6271a-FRA
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 render.v1.js Show response
static.adsnative.com/static/js/ 58 KB
18 KB 39ms
14ms Script
application/javascript 151.139.239.5
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsnative.com/static/js/render.v1.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 151.139.239.5 Dallas, United States, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 74206b30414ac55c78c015a40c2254282ec2c6fe3288c53e1c58bcb4a2c5788b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
last-modified: Tue, 08 May 2018 20:59:17 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 0B130E8EE4EFED0E
etag: W/"7fae18eeba79383e05026db710636030"
x-cache: HIT
content-language: en
status: 200
content-type: application/javascript
x-amz-version-id: u60lF79y_lMcaFgcqWC0InLDgnADcm3o
x-amz-id-2: 2pcwvdV0UubHxWqoB4aHmbliKK56FV1WMdIqGfJl5EBTovXpwLQNxg41QH42+f0IQgOv3Ec30kA=

GET
S 200 conversion.js Show response
www.googleadservices.com/pagead/ 18 KB
7 KB 19ms
15ms Script
text/javascript 172.217.22.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.22.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

23941ad2251c35265baba97eef46e43b7ba2341a9d3b4e13f69b41eddb61c2e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 17675284145658750604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 6805
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:00 GMT

GET
S 200 iwk-it-network-dr.gif
img.deusm.com/darkreading/ 3 KB
3 KB 11ms
8ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/iwk-it-network-dr.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 02 Nov 2016 13:53:05 GMT
server: cloudflare
etag: "abc-54051c29ab240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424928cc6349-FRA
content-length: 2748

GET
S 200 DR_mobile_User_nav.png
img.deusm.com/darkreading/ 1 KB
2 KB 13ms
10ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_mobile_User_nav.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "5be-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928ce6349-FRA
content-length: 1470

GET
S 200 spacer.gif
img.deusm.com/images/ 49 B
105 B 16ms
13ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2000 01:54:07 GMT
server: cloudflare
etag: "31-3737c29f20dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424928cf6349-FRA
content-length: 49

GET
S 200 DR_search.png
img.deusm.com/darkreading/ 2 KB
2 KB 30ms
27ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_search.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "7e9-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928d06349-FRA
content-length: 2025

GET
S 200 DR_mobile_SM.png
img.deusm.com/darkreading/ 2 KB
2 KB 25ms
23ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_mobile_SM.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "864-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928d16349-FRA
content-length: 2148

GET
S 200 DR-sections-nav.png
img.deusm.com/darkreading/ 2 KB
2 KB 32ms
30ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-sections-nav.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "9aa-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928d26349-FRA
content-length: 2474

GET
S 200 mobile_close.jpg
img.deusm.com/darkreading/ 2 KB
2 KB 17ms
14ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/mobile_close.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 13 Mar 2014 12:44:20 GMT
server: cloudflare
etag: "638-4f47c4fdf5100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424928d36349-FRA
content-length: 1592

GET
S 200 darkreading-logo.gif
img.deusm.com/darkreading/ 4 KB
5 KB 31ms
29ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/darkreading-logo.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 545712edaa3b24336596165ffc141ae4b85fbf5d8c566b48c28b16ab7df1edf0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 02 Nov 2016 13:53:00 GMT
server: cloudflare
etag: "11a7-54051c24e6700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424928d46349-FRA
content-length: 4519

GET
S 200 joinuslive.gif
img.deusm.com/darkreading/ 2 KB
2 KB 12ms
10ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/joinuslive.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 125a206a2b5c62726d73e063719b503d74bf109a09e9bc1e947d42726c0b3feb

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 02 Nov 2016 13:52:50 GMT
server: cloudflare
etag: "683-54051c1b5d080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424928d56349-FRA
content-length: 1667

GET
S 200 InteropITX_logo_white.png
twimgs.com/nojitter/darkreading/images/ 4 KB
4 KB 11ms
9ms Image
image/png 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/nojitter/darkreading/images/InteropITX_logo_white.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0179da0ede0f18ac31fbbb4030d9de3c9ae07fdbd294e45abea0f9f74d6784c

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 15 Dec 2017 20:29:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 418b424928e5271a-FRA
content-length: 4098
expires: Fri, 11 May 2018 09:08:02 GMT

GET
S 200 Jai-Vijayan.jpg
img.deusm.com/informationweek/ 11 KB
11 KB 24ms
22ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/Jai-Vijayan.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e9b6fed568a85ee88f1eb2aa1d51cb2073d907cbb0109a5dd703f0b1e5651d6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Mon, 29 Sep 2014 13:34:14 GMT
server: cloudflare
etag: "2c67-5043452972180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424928d66349-FRA
content-length: 11367

GET
S 200 editor-TW.png
img.deusm.com/informationweek/ 2 KB
2 KB 16ms
14ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-TW.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32821e69d091e71a62b9dbefcd09516c2133b50c50a3f8d597207d9cab5d59b8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:41 GMT
server: cloudflare
etag: "60d-4eb2828b4cf40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928d76349-FRA
content-length: 1549

GET
S 200 editor-IN.png
img.deusm.com/informationweek/ 1 KB
2 KB 17ms
15ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-IN.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5cc2027e2da5b3d553fba6a4d2d7276aafa604001e9b0321e18d1fd62b03b3f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:41 GMT
server: cloudflare
etag: "5b7-4eb2828b4cf40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928d86349-FRA
content-length: 1463

GET
S 200 editor-RSS.png
img.deusm.com/informationweek/ 2 KB
2 KB 225ms
223ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-RSS.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8f4fa7376444ffe05d0f7b296439401fb9729bdee84d760ee6286e7b663c753

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:41 GMT
server: cloudflare
etag: "6fa-4eb2828b4cf40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928da6349-FRA
content-length: 1786

GET
S 200 editor-email.png
img.deusm.com/informationweek/ 2 KB
2 KB 17ms
15ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-email.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 190f689e0f479324a217a5ea88c1acc132b66d24b16559052d59b892ff5dcba2

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:40 GMT
server: cloudflare
etag: "70f-4eb2828a58d00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928db6349-FRA
content-length: 1807

GET
S 200 DR-comment.png
img.deusm.com/darkreading/ 1011 B
1 KB 15ms
13ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:02 GMT
server: cloudflare
etag: "3f3-4f2ebd20ac480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928dc6349-FRA
content-length: 1011

GET
S 200 thumbs-up.png
img.deusm.com/darkreading/ 2 KB
2 KB 70ms
68ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/thumbs-up.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 16:09:21 GMT
server: cloudflare
etag: "607-4f4934ae90e40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928dd6349-FRA
content-length: 1543

GET
S 200 thumbs-down.png
img.deusm.com/informationweek/ 2 KB
2 KB 16ms
14ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/thumbs-down.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Nov 2013 19:20:31 GMT
server: cloudflare
etag: "624-4eba0acaa9dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424928de6349-FRA
content-length: 1572

GET
H2 200 email-decode.min.js Show response
www.darkreading.com/cdn-cgi/scripts/f2bf09f8/cloudflare-static/ 1 KB
780 B 18ms
15ms Script
application/javascript 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/cdn-cgi/scripts/f2bf09f8/cloudflare-static/email-decode.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

d86535603bd79537d32a08e173e8b56877377941756eb8550b1c69b1d10c4dfe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /cdn-cgi/scripts/f2bf09f8/cloudflare-static/email-decode.min.js
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
last-modified: Wed, 09 May 2018 11:00:10 GMT
server: cloudflare-nginx
etag: W/"5af2d4ba-441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800 public
cf-ray: 418b4241c82b96c4-FRA
expires: Sat, 12 May 2018 09:08:00 GMT

GET
S 200 widgets.js Show response
platform.twitter.com/ 123 KB
36 KB 6ms
6ms Script
application/javascript 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: e35e107c1e3d4ec87c9db64ce2f49381949ebc94b2356448140b4b2c3c4f661f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
age: 230
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 36338
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
last-modified: Mon, 07 May 2018 22:01:37 GMT
x-timer: S1525943282.733963,VS0,VE0
etag: "032b36172a4167c76faf336a933991e6+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=1800
accept-ranges: bytes

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 4 KB
2 KB 25ms
6ms Script
text/javascript 192.229.133.150
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 192.229.133.150 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41DF) /
Resource Hash: f83fe0b76074498c641025a5e7d08c6593186ea5c77a0a7df09a5ce26954d96a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:01 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV4
X-CDN: ECST
X-Cache: HIT
P3P: CP="CAO CUR ADM DEV PSA PSD OUR"
X-CDN-Proto: HTTP1
Content-Length: 1745
X-LI-UUID: DrGjLT0QLRUA+VcusyoAAA==
Server: ECS (fcn/41DF)
Last-Modified: Wed, 09 May 2018 19:21:43 GMT
X-Li-Pop: prod-edc2
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: max-age=86400
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-lva1
Expires: Thu, 10 May 2018 09:21:40 GMT

GET
S 200 Sheridan-IWK-125x125.jpg
img.deusm.com/informationweek/ 17 KB
17 KB 17ms
15ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/Sheridan-IWK-125x125.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88f6b155f6df559c17b78785558ec29de6429ef62232a26ad2ddbf8f8de07209

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Aug 2014 20:09:58 GMT
server: cloudflare
etag: "4206-5009c7d249180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424928df6349-FRA
content-length: 16902

GET
S 200 CurtisFranklin_125x125.gif
img.lightreading.com/enterpriseefficiency/ 12 KB
12 KB 76ms
31ms Image
image/gif 52.85.173.12
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.lightreading.com/enterpriseefficiency/CurtisFranklin_125x125.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 52.85.173.12 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-173-12.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c2ecd3ede424a34de162da4fdb7bb81feadf657f1984b86a47f8769e6a4453d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sun, 19 Nov 2017 06:59:08 GMT
via: 1.1 8ebc2b93de29d9744a950f4930f96579.cloudfront.net (CloudFront)
last-modified: Fri, 20 Jun 2014 19:04:51 GMT
server: AmazonS3
age: 75346
etag: "be1aa4bea644bff19f530fb030db64de"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 12440
x-amz-cf-id: s8nQx2AQrJbImysl8-mweswgw8jhJdgd3t52ycggxXSqzT6QE4buHw==

GET
S 200 ErickaChick_125x125.jpg
img.deusm.com/informationweek/ 6 KB
6 KB 13ms
8ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/ErickaChick_125x125.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66eab2665d25164ed81b2a6d20bcc87cfe524160006433569a438116a72bb245

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2013 17:46:49 GMT
server: cloudflare
etag: "1829-4ea99d9a1d440"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424a39916349-FRA
content-length: 6185

GET
S 200 NL-icon.png
img.deusm.com/informationweek/ 3 KB
3 KB 41ms
35ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/NL-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2013 15:09:43 GMT
server: cloudflare
etag: "a27-4eaabc5a3dbc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424a39936349-FRA
content-length: 2599

GET
S 200 ubm-tech.png
img.deusm.com/darkreading/ 7 KB
7 KB 36ms
31ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/ubm-tech.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b6908c1ddefad4b526966ba3f51d6e03f1f40747b658fbe64b9e3471ce6faf8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Tue, 25 Feb 2014 18:55:37 GMT
server: cloudflare
etag: "1cb3-4f33fa2395c40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424a39946349-FRA
content-length: 7347

GET
S 200 video-arrow_left_off.gif
img.deusm.com/darkreading/ 1 KB
1 KB 14ms
9ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/video-arrow_left_off.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 16:02:37 GMT
server: cloudflare
etag: "53e-4f49332d48140"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424a39956349-FRA
content-length: 1342

GET
S 200 spacer.gif
img.lightreading.com/images/ 49 B
353 B 53ms
9ms Image
image/gif 52.85.173.12
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.lightreading.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 52.85.173.12 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-173-12.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Mon, 10 Jul 2017 02:47:19 GMT
via: 1.1 8ebc2b93de29d9744a950f4930f96579.cloudfront.net (CloudFront)
last-modified: Fri, 20 Jun 2014 19:05:53 GMT
server: AmazonS3
age: 7065
etag: "4909631c93ffa90e65247e3fd4454f2d"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 49
x-amz-cf-id: wbiRkImIMd2BNrg1x6pDio884azNkEfhkRsr3CdzTtGQdgEVmHRAoA==

GET
S 200 comment.png
img.deusm.com/informationweek/ 1 KB
1 KB 14ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Nov 2013 19:22:53 GMT
server: cloudflare
etag: "446-4eba0b5215d40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424a39966349-FRA
content-length: 1094

GET
S 200 video-arrow_right_on.gif
img.deusm.com/darkreading/ 2 KB
3 KB 182ms
176ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/video-arrow_right_on.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 15:55:19 GMT
server: cloudflare
etag: "9f7-4f49318b927c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424a39986349-FRA
content-length: 2551

GET
S 200 Aprilcontest.jpg
img.deusm.com/darkreading/MarilynCohodas/ 177 KB
177 KB 15ms
9ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/MarilynCohodas/Aprilcontest.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 383cc116f6560c2519e7774a6595db81f6d755fdd6dad90960f4552f3719cf5f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Apr 2018 19:08:25 GMT
server: cloudflare
etag: "2c26a-56ab0feca1c5b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424a39996349-FRA
content-length: 180842

GET
S 200 Cover11_987.jpg
img.deusm.com/darkreading/ 35 KB
36 KB 38ms
33ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/Cover11_987.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04170a98834aa994b15c87f1583c53a6be09280ec4b571c6accc45a832c2e33c

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 15 Feb 2018 06:51:02 GMT
server: cloudflare
etag: "8d8f-5653aa6a6a180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424a399a6349-FRA
content-length: 36239

GET
H2 200 survey_jspage.asp Show response
www.darkreading.com/ 7 KB
1 KB 140ms
139ms Script
text/html 104.17.119.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/survey_jspage.asp?survey_id=130&cbust=213403

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.119.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

3f425dd0b2d02d28484158627724fd7f108100abed86656ae430d3f820f3068c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /survey_jspage.asp?survey_id=130&cbust=213403
pragma: no-cache
cookie: __cfduid=d32019545a675ccf785209b3a63fae0e91525943279; darkreading_lastvisit=5/10/2018 5:08:00 AM; cplChannelTagID=; darkreading%2Dmeter=1331736; darkreading%5Fvisits=2
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
server: cloudflare
x-frame-options: SAMEORIGIN
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
status: 200
cache-control: private
set-cookie: darkreading_lastvisit=5/10/2018 5:08:00 AM; expires=Tue, 10-May-2033 09:08:0 GMT; path=/; HttpOnly darkreading%5Fvisits=3; expires=Tue, 10-May-2033 04:00:00 GMT; path=/
cf-ray: 418b4241c82c96c4-FRA

GET
H/1.1 200
OK DR_ThreatConnect_Report.png
dsimg.ubm-us.net/asset/393933/543593/ 47 KB
47 KB 116ms
112ms Image
image/png 192.155.48.22
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsimg.ubm-us.net/asset/393933/543593/DR_ThreatConnect_Report.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 192.155.48.22 New Hyde Park, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS: dsimg.ubm-us.net
Software: Apache/2.4.6 (Red Hat Enterprise Linux) /
Resource Hash: 15a0cfb80399dabbd5491d35412f466ee877fc01651bbaa53b063cf55100c473

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:02 GMT
Last-Modified: Fri, 15 Dec 2017 21:07:09 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux)
ETag: "ba42-5606762339954"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 47682

GET
S 200 DR-bug.png
img.deusm.com/darkreading/ 1 KB
2 KB 36ms
31ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-bug.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:01 GMT
server: cloudflare
etag: "5d2-4f2ebd1fb8240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424a399b6349-FRA
content-length: 1490

GET
S 200 dr-footer-logo-new.jpg
img.deusm.com/darkreading/ 5 KB
5 KB 36ms
31ms Image
image/jpeg 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/dr-footer-logo-new.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04f784c83e6dde0588704c7fcc52d62e657f5b09012bb62a1d309d3adc774306

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 09 Nov 2016 07:03:32 GMT
server: cloudflare
etag: "125e-540d8dad41900"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 418b424a399c6349-FRA
content-length: 4702

GET
S 200 footergreyblack.css
twimgs.com/nojitter/css/ 3 KB
958 B 46ms
11ms Stylesheet
text/css 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/footergreyblack.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4587735e3d5dc5ef5149eae835aeb69f971575da9d4a293d9bffbb1dc25afa6b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:00 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 10:50:58 GMT
server: cloudflare
etag: "d11-54e23bb5fe880"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 418b4241fcb7271a-FRA
content-length: 855
expires: Thu, 10 May 2018 13:08:00 GMT

GET
S 200 UBM_Logo_PMS669.png
img.deusm.com/images/ 1 KB
2 KB 35ms
30ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/UBM_Logo_PMS669.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 902118c5436b3d46d79f44c3f8e7012eb9acc9b4b341e034e7bf0259aca4b425

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Thu, 16 Feb 2017 13:10:17 GMT
server: cloudflare
etag: "5c4-548a584b7e040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424a399d6349-FRA
content-length: 1476

GET
S 200 elqCfg.js Show response
twimgs.com/informationweek/elqNow/ 3 KB
1 KB 9ms
8ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/informationweek/elqNow/elqCfg.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45e31bcb4f072d9f442333ad139c3085bcf881955711d866035342f3028f4558

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 04 May 2011 21:27:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b42485885271a-FRA
expires: Fri, 11 May 2018 09:08:01 GMT

GET
S 200 elqImg.js Show response
twimgs.com/informationweek/elqNow/ 713 B
491 B 9ms
7ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/informationweek/elqNow/elqImg.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c94ad448b05002218551938d40e2baf3617a3d56a4455729d84993a5b7b311cf

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 28 Oct 2013 20:43:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b42485886271a-FRA
expires: Fri, 11 May 2018 09:08:01 GMT

GET
S 200 dev_adBlockerTrack.js Show response
twimgs.com/nojitter/js/ 2 KB
891 B 10ms
8ms Script
application/javascript 104.27.133.199
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/dev_adBlockerTrack.js?v1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.27.133.199 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9053ec3a7a0bdbdcb96173299c0ba89bc15f3134849fff570e37d6322676304

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 14 Feb 2018 09:08:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 418b42485887271a-FRA
expires: Fri, 11 May 2018 09:08:01 GMT

GET
S 200 ubm-tech-global-app-measurement.js Show response
epromos.ubmcanon.com/s_code/ 56 KB
21 KB 37ms
36ms Script
text/javascript 104.24.5.82
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://epromos.ubmcanon.com/s_code/ubm-tech-global-app-measurement.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.5.82 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe50c06b49da3d31f459190418cf158d5fe350ed0e4e4124b023a4a477ef2df1

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 24 Apr 2018 23:51:07 GMT
server: cloudflare
etag: W/"180789-df3e-56aa0d3fb8908"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 418b424858bf9810-FRA
expires: Thu, 10 May 2018 13:08:02 GMT

GET
H2

200

spacer.gif
img.deusm.com/images/
Redirect Chain

https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F314&f=%2Fdarkreading%2Fsection%2F314%2F1331736&rndserial=18480
https://img.deusm.com/images/spacer.gif

49 B
388 B

45ms
14ms

Image
image/gif

104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

:path: /images/spacer.gif
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: img.deusm.com
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
:scheme: https
:method: GET
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2000 01:54:07 GMT
server: cloudflare
etag: "31-3737c29f20dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
set-cookie: __cfduid=d27c5f4c3636f803e59d0f2fa0cc0fd821525943281; expires=Fri, 10-May-19 09:08:01 GMT; path=/; domain=.deusm.com; HttpOnly
accept-ranges: bytes
cf-ray: 418b42461ed36349-FRA
content-length: 49

Redirect headers

date: Thu, 10 May 2018 09:08:01 GMT
server: cloudflare
status: 302
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/html
location: https://img.deusm.com/images/spacer.gif
cache-control: private
set-cookie: darkreading_lastvisit=5/10/2018 5:08:01 AM; expires=Tue, 10-May-2033 09:08:1 GMT; path=/; HttpOnly darkreading%5Fvisits=3; expires=Tue, 10-May-2033 04:00:00 GMT; path=/
cf-ray: 418b4241d84996c4-FRA

GET
S 200 lightreading_rating_dot_10x7.gif
img.deusm.com/lightreading/ 49 B
146 B 107ms
102ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/lightreading/lightreading_rating_dot_10x7.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Sep 2013 21:21:36 GMT
server: cloudflare
etag: "31-4e73bd694b800"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424a399e6349-FRA
content-length: 49

GET
S 200 twitter_intevol_18x18.gif
img.deusm.com/darkreading/ 619 B
718 B 14ms
9ms Image
image/gif 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/twitter_intevol_18x18.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Feb 2018 10:56:35 GMT
server: cloudflare
etag: "26b-564c561c21ec0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 418b424a399f6349-FRA
content-length: 619

GET
H/1.1 200
OK beacon-min.js Show response
ins.techweb.com/beacon/js/ 6 KB
6 KB 626ms
112ms Script
application/javascript 192.155.48.48
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.techweb.com/beacon/js/beacon-min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 192.155.48.48 New Hyde Park, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS: ins.techweb.com
Software: INS /
Resource Hash: a290ede885635a3f7bb2b8e630bf795f15dde146fea32520b775bee1b2926ff3

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:01 GMT
Last-Modified: Thu, 23 Mar 2017 17:04:42 GMT
Server: INS
ETag: W/"6108-1490288682000"
P3P: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 6108

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 362 B
1 KB 719ms
181ms XHR
application/json 34.214.245.56
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=77FB1CFE532B22840A490D45%40AdobeOrg&d_nsid=0&ts=1525943281008
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Protocol: HTTP/1.1
Server: 34.214.245.56 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-214-245-56.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 9b5f68587697f5848218ab49cfbb0d675f0062a18c2ab3c45cb98714e0bd032d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: usw2-prod-dcs-0fd4322a9.edge-usw2.demdex.com 5.29.1.20180508083900 3ms
Pragma: no-cache
Date: Thu, 10 May 2018 09:08:01 GMT
Content-Encoding: gzip
X-TID: hyzmrKU/QeU=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.darkreading.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=UTF-8
Content-Length: 299
Expires: Thu, 01 Jan 2009 00:00:00 GMT

GET
H/1.1

302
Found

id Show response
cmp.d3.sc.omtrdc.net/
Redirect Chain

https://ubmtech.d3.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731
https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-f...

0
-1 B

109ms
21ms

XHR
text/plain

172.82.228.18
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 172.82.228.18 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.d3.sc.omtrdc.net
Software: Omniture DC/2.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:01 GMT
Last-Modified: Fri, 11 May 2018 09:08:01 GMT
Server: Omniture DC/2.0.0
Access-Control-Allow-Origin: https://www.darkreading.com
xserver: www170
Access-Control-Allow-Methods: GET, POST, DELETE
P3P: CP="This is not a P3P policy"
Location: https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/plain
Content-Length: 0
Expires: Wed, 09 May 2018 09:08:01 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:01 GMT
Last-Modified: Fri, 11 May 2018 09:08:01 GMT
Server: Omniture DC/2.0.0
Access-Control-Allow-Origin: https://www.darkreading.com
xserver: www170
Access-Control-Allow-Methods: GET, POST, DELETE
P3P: CP="This is not a P3P policy"
Location: https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/plain
Content-Length: 0
Expires: Wed, 09 May 2018 09:08:01 GMT

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=WvQL8gAAAr49KxKk
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=73326496627335041393145404121337395503
https://dpm.demdex.net/ibs:dpid=411&dpuuid=WvQL8gAAAr49KxKk

42 B
767 B

183ms
182ms

Image
image/gif

34.214.245.56
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=411&dpuuid=WvQL8gAAAr49KxKk
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 34.214.245.56 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-214-245-56.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

DCS: usw2-prod-dcs-045a73cd4.edge-usw2.demdex.com 5.29.1.20180508083900 3ms
Pragma: no-cache
Date: Thu, 10 May 2018 09:08:02 GMT
X-TID: sm0IvOJqQGI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 2009 00:00:00 GMT

Redirect headers

Date: Thu, 10 May 2018 09:08:01 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=WvQL8gAAAr49KxKk
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H/1.1

302
Found

id Show response
ubmtech.d3.sc.omtrdc.net/
Redirect Chain

https://cmp.d3.sc.omtrdc.net/id?AQB=1&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-f...
https://ubmtech.d3.sc.omtrdc.net/id?AQB=1&vmr=true&&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-d...

0
-1 B

108ms
21ms

XHR
text/plain

172.82.228.18
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://ubmtech.d3.sc.omtrdc.net/id?AQB=1&vmr=true&&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 172.82.228.18 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.d3.sc.omtrdc.net
Software: Omniture DC /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:01 GMT
Last-Modified: Fri, 11 May 2018 09:08:01 GMT
Server: Omniture DC
Access-Control-Allow-Origin: null
xserver: www198
Access-Control-Allow-Methods: GET, POST, DELETE
P3P: CP="This is not a P3P policy"
Location: https://ubmtech.d3.sc.omtrdc.net/id?AQB=1&vmr=true&&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/plain
Content-Length: 0
Expires: Wed, 09 May 2018 09:08:01 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:01 GMT
Last-Modified: Fri, 11 May 2018 09:08:01 GMT
Server: Omniture DC
Access-Control-Allow-Origin: null
xserver: www198
Access-Control-Allow-Methods: GET, POST, DELETE
P3P: CP="This is not a P3P policy"
Location: https://ubmtech.d3.sc.omtrdc.net/id?AQB=1&vmr=true&&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/plain
Content-Length: 0
Expires: Wed, 09 May 2018 09:08:01 GMT

GET
H/1.1 200
OK id Show response
ubmtech.d3.sc.omtrdc.net/ 43 B
539 B 22ms
21ms XHR
application/x-javascript 172.82.228.18
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://ubmtech.d3.sc.omtrdc.net/id?AQB=1&vmr=true&&vmh=ubmtech.d3.sc.omtrdc.net&vmf=cmp.d3.sc.omtrdc.net&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=77239913704263148722690152409043453916&ts=1525943281731&AQE=1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 172.82.228.18 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.d3.sc.omtrdc.net
Software: Omniture DC /
Resource Hash: f2718791db2980bbc82507179cc1e0ba86537cdc4d673225d35cc092159f7c97

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Origin: null
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 10 May 2018 09:08:01 GMT
Server: Omniture DC
xserver: www185
Vary: Origin
Access-Control-Allow-Methods: GET, POST, DELETE
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 43
X-C: ms-6.2.1

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 362 B
1 KB 187ms
187ms XHR
application/json 34.214.245.56
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=77FB1CFE532B22840A490D45%40AdobeOrg&d_nsid=0&d_mid=77239913704263148722690152409043453916&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=AVID%012D7A05F885316D44-60000117200F8FA1&ts=1525943281975
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Protocol: HTTP/1.1
Server: 34.214.245.56 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-214-245-56.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 016c194f4c809cffab4c173fe6987a29a43262f715dff3f2f5e6e76d8cd17509

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: usw2-prod-dcs-3c468ce0.edge-usw2.demdex.com 5.29.1.20180508083900 7ms
Pragma: no-cache
Date: Thu, 10 May 2018 09:08:02 GMT
Content-Encoding: gzip
X-TID: Yg8NBdFqSJs=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.darkreading.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=UTF-8
transfer-encoding: chunked
Expires: Thu, 01 Jan 2009 00:00:00 GMT

GET
S 200 api.js Show response
www.google.com/recaptcha/ 834 B
565 B 21ms
17ms Script
text/javascript 172.217.23.132
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit

Requested by

Host: dsimg.ubm-us.net
URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js

Protocol

SPDY

Server

172.217.23.132 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s18-in-f4.1e100.net

Software

GSE /

Resource Hash

4ada788dd8ba30a9b04ecd041a177b99d6e7b7183bdf1da9c9d96497585a11dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 468
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:02 GMT

GET
S 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 23ms
6ms Script
text/javascript 172.217.22.104
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.22.104 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s18-in-f104.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Apr 2018 18:13:11 GMT
server: Golfe2
age: 5843
date: Thu, 10 May 2018 07:30:39 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 17168
expires: Thu, 10 May 2018 09:30:39 GMT

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ 14 KB
6 KB 52ms
39ms Script
text/javascript 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9256e67766caab23f205bba47f8a54eb740b1d8822be84888c449c93f9c198a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "4 / 104 of 1000 / last-modified: 1525914678"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 5819
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:02 GMT

GET
S 200 pubads_impl_203.js Show response
securepubads.g.doubleclick.net/gpt/ 163 KB
58 KB 56ms
42ms Script
text/javascript 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

56845977a56747959a170550b800acd5b5ec5db345d953c1f4b8d94feac234e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 02 May 2018 15:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 58861
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:02 GMT

GET
S 200 integrator.sync.js Show response
adservice.google.de/adsid/ 115 B
666 B 59ms
45ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=www.darkreading.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

be04ee6479e67725d2dcd744cdacd0cc551e96d3a5318d0e6339fce3b0547839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 109
x-xss-protection: 1; mode=block

GET
S 200 json Show response
ubm.tt.omtrdc.net/m2/ubm/mbox/ 97 B
576 B 95ms
39ms XHR
application/json 66.117.29.3
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://ubm.tt.omtrdc.net/m2/ubm/mbox/json?mbox=target-global-mbox&mboxSession=a5cf2aaa2d6242f68d868fd74e4769f6&mboxPC=&mboxPage=6220b60b9951445593399d27ff8ed69e&mboxVersion=1.0.0&mboxCount=1&mboxTime=1525943282165&mboxHost=www.darkreading.com&mboxURL=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&mboxReferrer=https%3A%2F%2Ft.co%2FXK6tlvz48H&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&mboxMCGVID=77239913704263148722690152409043453916&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCAVID=2D7A05F885316D44-60000117200F8FA1&mboxMCGLH=9&vst.trk=ubmtech.d3.sc.omtrdc.net&vst.trks=ubmtech.d3.sc.omtrdc.net&mboxMCSDID=275191D4497C2ACC-619DCE6A898B00A4
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/at.js?ormzkk
Protocol: SPDY
Server: 66.117.29.3 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: /
Resource Hash: 151a924bc325e3a9aa3871705cc3d24900b7078a6b2339e7c5c4f162087d083a

Request headers

Accept: application/json
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:01 GMT
content-type: application/json;charset=UTF-8
status: 200
vary: Origin
p3p: CP="NOI DSP CURa OUR STP COM", CP="NOI DSP CURa OUR STP COM"
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 97
x-application-context: edge:prod,prod-prod26,prod-prod26-app,prod26:11180

GET
H/1.1 200
OK / Show response
api-cache.adsnative.com/v1/host/www.darkreading.com/ 23 B
584 B 207ms
6ms Script
application/json 23.111.11.217
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cache.adsnative.com/v1/host/www.darkreading.com/?&callback=an_callback_lookup
Requested by: Host: static.adsnative.com
URL: https://static.adsnative.com/static/js/render.v1.js
Protocol: HTTP/1.1
Server: 23.111.11.217 Phoenix, United States, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bec4f2f082be46c47ba8f2398813bb3c90495d69405fa0981506b1fd13ba29d6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:02 GMT
Server: NetDNA-cache/2.2
Vary: Accept-Language
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Language: en
Cache-Control: max-age=900
Access-Control-Allow-Credentials: true
X-From: an-prod-ralphie-frontline-riyal.us-east-1
X-Cache: HIT
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
Content-Length: 23

GET
H/1.1

200
OK

cm.gif
rudy.adsnative.com/
Redirect Chain

https://rudy.adsnative.com/cm.gif
https://bh.contextweb.com/bh/rtset?do=add&pid=558079&ev=9999&rurl=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fdspid%3D159402804%26buid%3D%25%25VGUID%25%25
https://rudy.adsnative.com/cm.gif?dspid=159402804&buid=7qXBPh65TJWu&ev=9999&pid=558079&do=add
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fdspid%3D823634934%26buid%3D%23PM_USER_ID
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fdspid%3D823634934%26buid%3D%23PM_USER_ID&rdf=1
https://rudy.adsnative.com/cm.gif?dspid=823634934&buid=D4598CB7-FD76-4E8D-8F75-8DDB20753BFB
https://sync.srv.stackadapt.com/sync?nid=46
https://rudy.adsnative.com/cm.gif?dspid=1038693605&buid=0-69f06723-48a5-48a0-754c-fd76c7fb1608$ip$148.251.45.254
https://srv.stackadapt.com/sync?nid=5
https://rudy.adsnative.com/cm.gif?dspid=1416370744&buid=0-69f06723-48a5-48a0-754c-fd76c7fb1608$ip$148.251.45.254
https://sync.outbrain.com/uidsyncpixel?url=https%3A%2F%2Frudy.adsnative.com%2Fcm.gif%3Fbuid%3D%7BUUID%7D%26dspid%3D349348236&puuid=fb9c4d8f-e1d2-45ae-8249-a21a4574f911&dspid=349348236
https://rudy.adsnative.com/cm.gif?buid=fb9c4d8f-e1d2-45ae-8249-a21a4574f911&dspid=349348236

42 B
467 B

31ms
30ms

Image
image/gif

52.30.94.36
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rudy.adsnative.com/cm.gif?buid=fb9c4d8f-e1d2-45ae-8249-a21a4574f911&dspid=349348236
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 52.30.94.36 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-30-94-36.eu-west-1.compute.amazonaws.com
Software: nginx/1.13.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:03 GMT
Server: nginx/1.13.1
Connection: keep-alive
Etag: "d5fceb6532643d0d84ffe09c40c481ecdf59e15a"
Content-Length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=0; includeSubDomains;
via: 1.1 varnish, 1.1 varnish
traffic-path: NYDC1, JFK, FRA, Europe1
x-timer: S1525943284.562241,VS0,VE80
date: Thu, 10 May 2018 09:08:03 GMT
x-served-by: cache-jfk8151-JFK, cache-fra19126-FRA
status: 302
x-cache: MISS, MISS
location: https://rudy.adsnative.com/cm.gif?buid=fb9c4d8f-e1d2-45ae-8249-a21a4574f911&dspid=349348236
backend-ip: 104.156.90.51
accept-ranges: bytes, bytes
content-length: 0
x-cache-hits: 0, 0

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 24ms
7ms Script
application/x-javascript 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:02 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 901
Expires: Fri, 11 May 2018 09:08:02 GMT

GET
S 200 fbevents.js Show response
connect.facebook.net/en_US/ 39 KB
12 KB 6ms
6ms Script
application/x-javascript 185.60.216.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

112560223d7dcf6f78bd1f4f1271590233b6cd02adf7a10f896b0f628c2c4d24

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 12398
x-xss-protection: 0
pragma: public
x-fb-debug: YSIOjxrm3e13tzMZqkv8pQZ/5VDlt0lTeuB5TK2QYCmuS8GWy0B8zU69t3tDqVKdhbf6GkHwnpz898W2gpy4nw==
x-frame-options: DENY
date: Thu, 10 May 2018 09:08:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 3 KB
1 KB 43ms
11ms Script
application/javascript 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=32069&u=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&r=0.08736792599524512
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 159.122.87.153 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: 99.57.7a9f.ip4.static.sl-reverse.com
Software: dacdn2 /
Resource Hash: de66d9425871940178975c9a97709c4a49da21a4096a28ee9520e432cfc188c4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status: 200
date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
server: dacdn2
content-type: application/javascript; charset=UTF-8

GET
S 200 log.js Show response
u.heatmap.it/ 26 KB
11 KB 35ms
9ms Script
application/x-javascript 46.105.202.39
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u.heatmap.it/log.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 1b98caa8ae42dad5f41203561254ff379ef96a2a63372156972f9c193c88ab18

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
last-modified: Mon, 26 Mar 2018 20:32:23 GMT
x-cdn-pop-ip: 137.74.120.32/27
x-cacheable: Matched cache
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
status: 200
cache-control: max-age=3600
x-cdn-pop: sbg
accept-ranges: bytes
content-length: 10636
expires: Wed, 09 May 2018 18:06:59 GMT

GET
S 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/ 2 KB
1 KB 22ms
22ms Script
text/javascript 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/?random=1525943282267&cv=9&fst=1525943282267&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&ref=https%3A%2F%2Ft.co%2FXK6tlvz48H&tiba=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s18-in-f104.1e100.net

Software

cafe /

Resource Hash

973bb16b486fcfb6522fa98f3d0abd07071a92352aef28caad92b8b57c32070b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1012
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 bat.js Show response
bat.bing.com/ 14 KB
5 KB 32ms
32ms Script
application/javascript 204.79.197.200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 204.79.197.200 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: a-0001.a-msedge.net
Software: /
Resource Hash: 4d523cdc48932d683a31ac5210ac152d61ad69393ad4200914deec8b96d154d7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
last-modified: Thu, 03 May 2018 17:20:11 GMT
x-msedge-ref: Ref A: 659F9E40198C405DA6FA607C2B45E61A Ref B: FRAEDGE0517 Ref C: 2018-05-10T09:08:02Z
status: 200
etag: "80d7b7fd2e3d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 4428

GET
S 200 all.js Show response
connect.facebook.net/en_US/ 206 KB
62 KB 6ms
6ms Script
application/x-javascript 185.60.216.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

62b679ec0d2a42b2b35753ce6676d3546919423241dd7f436e493efd5ae73eb0

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: iyCyXm8KxEQYKakO3e46Nw==
status: 200
content-length: 63267
x-xss-protection: 0
x-fb-debug: J3B/06m48X+ybjiTyFqc9uMk9p6IiC8nJoLFrYHUHWd9CoCiAo5Sd6WnxfPzwnenKpLZP38joESxwSlVzR9p9Q==
x-fb-content-md5: 03023a75a851e56636525acbbd94868b
x-frame-options: DENY
date: Thu, 10 May 2018 09:08:02 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "1aba8c49947d2d737d7f6faf6da281a2"
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
timing-allow-origin: *
expires: Thu, 10 May 2018 09:18:03 GMT

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 57 KB
16 KB 347ms
347ms Script
text/javascript 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=1715927646485957&output=json_html&callback=googletag.impl.pubads.setAdContentsBySlotForSync&impl=ss&adsid=NT&json_a=1&vrg=203&guci=1.2.0.0.2.2&sc=1&sfv=1-0-23&iu_parts=2441%2Cdarkreading%2Cattacks_breaches&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=2x2%2C5x5%2C300x250%7C336x280%7C300x600%7C336x850%2C6x6%2C1x2%2C728x90%7C970x250%2C336x27%2C300x250%7C336x280%7C300x600%7C336x850%2C300x60%2C3x3%2C4x4%2C8x2%2C8x4&prev_scp=pos%3Dwelcome%7Cpos%3DTAPunit%7Cpos%3Drec1%7Cpos%3Dpromo%7Cpos%3Dwallpaper%7Cpos%3Dtop%7Cpos%3Dlogo%7Cpos%3Drec2%7Cpos%3Deventpromo%7Cpos%3Dribbon%7Cpos%3Dvideo%7Cpos%3Dnative%7Cpos%3Dinsight&cust_params=kw%3DAdvanced_Threats%252CApplications%252CAttacks%252CAttacks-Breaches%252CBreaches%26aid%3D1331736&cookie_enabled=1&bc=7&abxe=1&lmt=1525943282&dt=1525943282279&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=0%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=770981021%2C2285942263%2C4220632109%2C4159207384%2C2332965166%2C2966194094%2C2269036440%2C4220632108%2C1032152201%2C885452677%2C693593060%2C929715771%2C3939335409&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&ref=https%3A%2F%2Ft.co%2FXK6tlvz48H&dssz=47&icsg=1030792978440&std=0&csl=58&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x1200%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0&ga_vid=77597816.1525943282&ga_sid=1525943282&ga_hid=1777663150

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

02f61f6dafa09f6e5178d8803b4e1d645646148b79cee25a65c674e27233093d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 15830
x-xss-protection: 1; mode=block
google-lineitem-id: 140048676,4461146792,4461146792,-2,4461146792,4563790701,-2,4668233716,-2,-2,42403476,4624189147,4660302621
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 96102516636,138232753628,138232798765,-2,138232753631,138226127483,-2,138232936228,-2,-2,138212589663,138232067238,138232135337
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_203.js Show response
securepubads.g.doubleclick.net/gpt/ 43 KB
16 KB 41ms
40ms Script
text/javascript 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_203.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

a9f7e804bc04fde0a1d57e54f53b9db40da92751fa660e843d9834720c1fd494

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 02 May 2018 15:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 16616
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:02 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-23/html/ 0
0 21ms
5ms Other
text/html 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-23/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js
Protocol: SPDY
Server: 172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra16s18-in-f1.1e100.net
Software: /
Resource Hash

Request headers

Purpose: prefetch
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

expires: Thu, 09 May 2019 10:27:31 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 10 Apr 2018 14:51:09 GMT
content-type: text/html

GET
H/1.1 200
OK Cookie set dest5.html
ubm.demdex.net/ Frame FFDB 0
0 765ms
185ms Document
text/html 35.166.206.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ubm.demdex.net/dest5.html?d_nsid=0
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.166.206.214 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-166-206-214.us-west-2.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Host: ubm.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Accept-Encoding: gzip, deflate
Cookie: demdex=73326496627335041393145404121337395503
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 10 May 2018 09:08:02 GMT
DCS: usw2-prod-dcs-d2448e0e.edge-usw2.demdex.com 5.29.1.20180508083900 0ms
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 10 May 2018 08:51:08 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie: demdex=73326496627335041393145404121337395503;Path=/;Domain=.demdex.net;Expires=Tue, 06-Nov-2018 09:08:02 GMT
Vary: Accept-Encoding, User-Agent
X-TID: uQ6p5pbJRGM=
Content-Length: 2944
Connection: keep-alive

GET
S 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/api2/v1525468050349/ 231 KB
75 KB 6ms
5ms Script
text/javascript 172.217.23.131
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/api2/v1525468050349/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit

Protocol

SPDY

Server

172.217.23.131 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s18-in-f3.1e100.net

Software

sffe /

Resource Hash

0639db2530781322ac530d6b82c4a1213fddcf911b8cff9afb5576220bafae0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Fri, 04 May 2018 23:07:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 04 May 2018 22:15:00 GMT
server: sffe
age: 468058
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 76311
x-xss-protection: 1; mode=block
expires: Sat, 04 May 2019 23:07:04 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1525943282324&ns_c=windows-1252&cv=3.1&c8=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c7=https%3A%2F%2Fwww.darkreadin...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1525943282324&ns_c=windows-1252&cv=3.1&c8=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c7=https%3A%2F%2Fwww.darkreadi...

0
248 B

6ms
6ms

Image
text/plain

2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1525943282324&ns_c=windows-1252&cv=3.1&c8=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&c9=https%3A%2F%2Ft.co%2FXK6tlvz48H
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:02 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1525943282324&ns_c=windows-1252&cv=3.1&c8=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&c9=https%3A%2F%2Ft.co%2FXK6tlvz48H
Pragma: no-cache
Date: Thu, 10 May 2018 09:08:02 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 832000476880185 Show response
connect.facebook.net/signals/config/ 55 KB
13 KB 6ms
6ms Script
application/x-javascript 185.60.216.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/832000476880185?v=2.8.14&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

SPDY

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

a4fd9555e1cd105ee5a63560455f14735d983dbcdfc8e6d55d6a436c2142e313

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 13395
x-xss-protection: 0
pragma: public
x-fb-debug: mcqU33PLfigC8wDyNvQEifz3UZm6/wszum9venXYOVGGI8tMwmbuD36inH+v4OsTThZ80IkCuj67Fy/Zs8CZ2g==
x-frame-options: DENY
date: Thu, 10 May 2018 09:08:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
199 B 16ms
16ms Image
image/gif 172.217.22.104
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=20171761&utmhn=www.darkreading.com&utmcs=windows-1252&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&utmhid=1777663150&utmr=https%3A%2F%2Ft.co%2FXK6tlvz48H&utmp=%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&utmht=1525943282346&utmac=UA-30302365-1&utmcc=__utma%3D199458747.77597816.1525943282.1525943282.1525943282.1%3B%2B__utmz%3D199458747.1525943282.1.1.utmcsr%3Dt.co%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2FXK6tlvz48H%3B&utmjid=1722964832&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAQAAAAE~

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.22.104 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.google.com/ads/user-lists/1007530244/ 42 B
116 B 15ms
14ms Image
image/gif 172.217.23.132
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/user-lists/1007530244/?random=1525943282267&cv=9&fst=1525942800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&ref=https%3A%2F%2Ft.co%2FXK6tlvz48H&tiba=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&fmt=3&cdct=2&is_vtc=1&random=236865208&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.23.132 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s18-in-f4.1e100.net

Software

adclick_server /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:02 GMT
x-content-type-options: nosniff
server: adclick_server
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.google.de/ads/user-lists/1007530244/ 42 B
107 B 16ms
15ms Image
image/gif 172.217.18.163
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/user-lists/1007530244/?random=1525943282267&cv=9&fst=1525942800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&ref=https%3A%2F%2Ft.co%2FXK6tlvz48H&tiba=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&fmt=3&cdct=2&is_vtc=1&random=236865208&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.18.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s29-in-f3.1e100.net

Software

adclick_server /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:02 GMT
x-content-type-options: nosniff
server: adclick_server
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 204 www.darkreading.com.js Show response
u.heatmap.it/conf/ 0
119 B 70ms
69ms Script
text/plain 46.105.202.39
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u.heatmap.it/conf/www.darkreading.com.js
Requested by: Host: u.heatmap.it
URL: https://u.heatmap.it/log.js
Protocol: SPDY
Server: 46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status: 204
date: Thu, 10 May 2018 09:08:02 GMT
x-cdn-pop: sbg
x-cacheable: Cacheable
x-cdn-pop-ip: 137.74.120.32/27
expires: Thu, 10 May 2018 09:13:02 GMT

GET
S 200 va-e59397020665cc5f9e1f9237b07ac72c.js Show response
dev.visualwebsiteoptimizer.com/track/ 125 KB
43 KB 12ms
11ms Script
text/javascript 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/track/va-e59397020665cc5f9e1f9237b07ac72c.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 159.122.87.153 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: 99.57.7a9f.ip4.static.sl-reverse.com
Software: dacdn2 /
Resource Hash: 1c1aafa951b0202a4ea5114f9b1344baa410bc72811ba3e3834aea6391c5f00a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
last-modified: Fri, 04 May 2018 12:35:33 GMT
server: dacdn2
status: 200
etag: "5aec5395-acc8"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 44232

GET
S 200 track-e59397020665cc5f9e1f9237b07ac72c.js Show response
dev.visualwebsiteoptimizer.com/track/ 16 KB
6 KB 34ms
33ms Script
text/javascript 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/track/track-e59397020665cc5f9e1f9237b07ac72c.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 159.122.87.153 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: 99.57.7a9f.ip4.static.sl-reverse.com
Software: dacdn2 /
Resource Hash: f9b0a8bcc91ed7136ce89dd900f73f9efd8b71de479232df493e2d708bc2460b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
last-modified: Fri, 04 May 2018 12:35:33 GMT
server: dacdn2
status: 200
etag: "5aec5395-1522"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5410

GET
S 200 opa-1b829bce79fbb94ca7fcfd0fbed69853.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 144 KB
46 KB 34ms
34ms Script
application/javascript 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/opa-1b829bce79fbb94ca7fcfd0fbed69853.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 159.122.87.153 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: 99.57.7a9f.ip4.static.sl-reverse.com
Software: dacdn2 /
Resource Hash: 77a374f96010219c3d3f057c3055f657b9c4a919ff4373da99ea36ff8295daec

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:01 GMT
content-encoding: gzip
last-modified: Thu, 03 May 2018 12:45:18 GMT
server: dacdn2
status: 200
etag: W/"5aeb045e-2413c"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800

GET
S 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
236 B 34ms
34ms Image
image/gif 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?a=32069&d=darkreading.com&u=DC746D2DAAE71FACBAA992B9590511241&h=1a530f2d22020cd932dc9b698d42db5c&t=false&r=0.015372773887931457

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

159.122.87.153 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),

Reverse DNS

99.57.7a9f.ip4.static.sl-reverse.com

Software

dacdn2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:01 GMT
x-content-type-options: nosniff
server: dacdn2
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
247 B 7ms
7ms Image
image/gif 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=832000476880185&ev=PageView&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&rl=https%3A%2F%2Ft.co%2FXK6tlvz48H&if=false&ts=1525943282369&sw=1600&sh=1200&v=2.8.14&r=stable&ec=0&o=28&it=1525943282333
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Thu, 10 May 2018 09:08:02 GMT

GET
S 204 0
bat.bing.com/action/ 0
93 B 31ms
30ms Image
text/plain 204.79.197.200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5476211&Ver=2&mid=f9e39f7e-928f-9672-8144-7cf6e43c104e&evt=pageLoad&sid=1437abab-1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&r=https%3A%2F%2Ft.co%2FXK6tlvz48H&p=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&msclkid=N&rn=123356
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 204.79.197.200 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: a-0001.a-msedge.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Thu, 10 May 2018 09:08:01 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: CF73A89026E9412FABAD501D0BAB9E3B Ref B: FRAEDGE0517 Ref C: 2018-05-10T09:08:02Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 background-pattern.png
img.deusm.com/darkreading/ 493 B
569 B 14ms
14ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/background-pattern.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:01 GMT
server: cloudflare
etag: "1ed-4f2ebd1fb8240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424ada1d6349-FRA
content-length: 493

GET
S 200 /
www.facebook.com/impression.php/f1b96ecf4442d4/ 43 B
199 B 42ms
42ms Image
image/gif 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/impression.php/f1b96ecf4442d4/?api_key=640989409269461&lid=115&payload=%7B%22source%22%3A%22jssdk%22%7D

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
x-xss-protection: 0
pragma: no-cache
x-fb-debug: kF6UeYKl13BgaV4ahL/Q7rVzdzqS03CeuWV7AEqSHTjrI0kbw/2cJIhcFpjudBgIZL1zrDaDPMrKgD4wrnl2uw==
date: Thu, 10 May 2018 09:08:02 GMT
expect-ct: max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security: max-age=15552000; preload
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 RQ7NiRXMcYA.js
staticxx.facebook.com/connect/xd_arbiter/r/ Frame 506A 0
0 6ms
6ms Document
text/html 185.60.216.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://staticxx.facebook.com/connect/xd_arbiter/r/RQ7NiRXMcYA.js?version=42

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: staticxx.facebook.com
:scheme: https
:path: /connect/xd_arbiter/r/RQ7NiRXMcYA.js?version=42
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
cookie: fr=0P3wBmUslZyhIth4U..Ba9Avy...1.0.Ba9Avy.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
expires: Thu, 09 May 2019 21:08:43 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: public,max-age=31536000,immutable
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
vary: Accept-Encoding
content-encoding: gzip
x-fb-debug: MJLRigL7tWBGFbRUUj6BEmG35jq6P6SHfVoJtDRjKYGPCz+9wEir+cvufoXM5HwwF5SWw3+JPS/DEe5z4G165A==
content-length: 13637
date: Thu, 10 May 2018 09:08:02 GMT

GET
S 200 worker-68f4c079a93008e8e04f81f6476e5cc4.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 46 KB
15 KB 37ms
13ms XHR
application/javascript 159.122.87.148
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-68f4c079a93008e8e04f81f6476e5cc4.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/opa-1b829bce79fbb94ca7fcfd0fbed69853.js
Protocol: SPDY
Server: 159.122.87.148 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: 94.57.7a9f.ip4.static.sl-reverse.com
Software: fra1dacdn /
Resource Hash: d11075cd7df2682b221d194573250d4aed0a6a4e3a151acf41d1b14053495b85

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
content-encoding: gzip
last-modified: Wed, 04 Oct 2017 11:55:02 GMT
server: fra1dacdn
status: 200
etag: W/"59d4cc16-b83e"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800, public, max-age=604800

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/ 70 KB
26 KB 6ms
6ms Script
text/javascript 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_203.js

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

8ce91b441f5986df8dcfb08b25e85caa723a8140e765458da08c62c8ba14173f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 07 May 2018 21:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213940
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 25838
x-xss-protection: 1; mode=block
server: cafe
etag: 1784613934527904873
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 May 2018 21:42:22 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 70 KB
26 KB 19ms
6ms Script
text/javascript 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

7aba6339112d11f818fcb85d4a742e9001a9d39025d1d96846ccd9adbb88f447

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 08:36:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1871
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 26333
x-xss-protection: 1; mode=block
server: cafe
etag: 6798591786600654950
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 10 May 2018 09:36:51 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
282 B 17ms
17ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv404xKgommBQ3i4-qDbbc7-myh-aM7-e5AIns-7myjjkzzu8uTCRvoW7Qme0l6SsQ5ZGYLwqw0gBf8YKl_EW6wRaXX3Elxh_m94YH2-vKlCVhJavoju8_MKfmXNKGl6F4BpaxIHREArNWOgRZnKyHeXlXS6AvW3QsmlCJLbS4rwLmjtd82x0Iz5DrmJd_YSKKDB2VBU1k6mknrzwRm4kLzW9oq7j4W1Z-FJyg_HcEGfcL8W6-A7UaaGIojHFVIeRvjLkBLoO_gKV60f18tTvVr99PCED85Ko-JftR_87y5EO_xmHbl0p4&sai=AMfl-YTK5S4WzC-fxEPfLEQwVbsrKELtmrbigiougZsn0M0sasqbgBGn2KaIEteapRzbgyBYDnYwor3wBPEf7kXzdZVZVqYVWjwWGiKV4Dq-&sig=Cg0ArKJSzGoZCkFnkQmEEAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
cache-control: private
expires: Thu, 10 May 2018 09:08:02 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
56 B 34ms
34ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstYs93ODg34sOpq_zLIDNaar610UPWXxUmTtw5t4j-_LkfGWenn5UKLNvmfp1bJyMucDne6jvAiughXHyM8Miwio5mzUO4N7510KHJ2No4W4HqEWJQYQYo1cYc7fgoZOel5D464Fj1K1zp63591WGtPzwlLm1XDzS8uEKob-_0NFz__KQhqIH4968KsQkyP0WMhcbaYFurnbdC1YlU2jGa_7Yxcip5G2q3SRWIdTYuOSLCruDmIb8tb1fD-1BM5U84PXHSJ8J-r-3cc9lHcFQSOsw&sai=AMfl-YRWpVf_CTKWDi_6o38KjLPGj2KK0Up3Xsa5aLjOwWqq8Qj0P0RPdK9fA1LSueE9Ve1etsDdQlLgVFJ-gKnD5feewq8NWw2MzW4MngVv&sig=Cg0ArKJSzFbeOSylDNc4EAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
S 200 imgad
tpc.googlesyndication.com/pagead/ 194 KB
195 KB 9ms
9ms Image
image/jpeg 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDrvcabDBABGAEyCPHom0MV2jBP

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

fa1d996a6276cbc48230181d792d45ca01784c0fb7fce99c85f85ff651bd4afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sun, 06 May 2018 20:51:14 GMT
x-content-type-options: nosniff
server: cafe
age: 303408
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/jpeg
status: 200
cache-control: public, max-age=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 199095
x-xss-protection: 1; mode=block
expires: Sun, 13 May 2018 20:51:14 GMT

GET
H/1.1 200
OK js Show response
voken.eyereturn.com/j4/ 4 KB
2 KB 393ms
97ms Script
application/x-javascript 65.39.202.98
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to

Full URL: https://voken.eyereturn.com/j4/js?6257264&click=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstDVZZx7TNHKhp-59Poi_6tnZ0IB0tWrbDOxSMivEbQexqCWHPQrI6hmVmneVge24xONyAVfLN03kgXWCrvmUIsZkIkM5mTMXDLpN_vrXFuJKaOuSfmphtJt-ytb66ZKXT5AUc8HseIUUPYNWhdgbw52agtxlyWNRrBE0DpU06sbFdEfSdurpfi3-25-KUTLsio-Xftt48ugF0wUqXMhljuOoRa4a6egLYx5hGAH5T9x7TDYKhXaCh0l7qUuTAuas-2HpCoK4Y9ZbvXnw%2526sai%253DAMfl-YQEFCIp_oINrm6UJgY6WWL_bAiVcqwdDaRVRjiF8fmCsJb0GNXrdo0cwNfJoeCB0g15Rh34GnUi0sicBY2gXixiD5LcDcKJPatPrmAu%2526sig%253DCg0ArKJSzHCWCzC_z6aeEAE%2526urlfix%253D1%2526adurl%253D&params=197645120
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_203.js
Protocol: HTTP/1.1
Server: 65.39.202.98 New York, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),
Reverse DNS
Software: nginx /
Resource Hash: ae715e47e2b4cba8b6af4beb471515375fd1066dc47b1071b3c83e3ab4e0a0e3

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
X-ER-LastUpdated: Thu May 10 05:06:12 EDT 2018
Server: nginx
Transfer-Encoding: chunked
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP NID PSAo PSDa OUR STP IND UNI COM NAV"
X-ER-RT: 0
Cache-Control: no-cache
Connection: keep-alive
Content-Type: application/x-javascript;charset=iso-8859-1
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
56 B 32ms
31ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsupdQoPRVqUXAJqODwcoVTVl4ZNUJZJjfvIXZy_c8VnGbod0VQNAQwREaTMjfNKLlLWvwvLdNVGDQTCdB5iRNfF4eCGBsb2Bd6H15z7pTmT4_X9B6hm2UrmuSqJNZ6ixpyLfOitUL2yx3e_wLo1obJDqtTbQMPbCQQGwK6ZV_xYIK5nuI7G-Kcuwu-8z7AfS4v5aII4q5ca9hkHAsixP2AtLpb17Lo3qiN82ollMcFPUMMLzrB14W9LQMRQ8sQ9t0dwneGT8tH9v0_RzTaxkQ&sai=AMfl-YR26yFG530S4rEaOHQQCIGeUKdDEX4NAT-aAi3NuIpJ8Bzq79mSE7Zn7kpg9e1wXmxPtqR_D5BmPxworFZGQOzW9yoX4zPf9rI9t2Sc&sig=Cg0ArKJSzM_Uty6Lj1kwEAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
S 200 /
www.facebook.com/tr/ 44 B
99 B 6ms
6ms Image
image/gif 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=832000476880185&ev=Microdata&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&rl=https%3A%2F%2Ft.co%2FXK6tlvz48H&if=false&ts=1525943282872&cd[Schema.org]=%5B%5D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20Feature%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Ftwimgs.com%2Fnojitter%2Fdarkreading%2Fdr-logo.jpg%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%22%2C%22og%3Asite_name%22%3A%22Dark%20Reading%22%2C%22og%3Adescription%22%3A%22New%20Process%20Doppelganging%2C%20obfuscation%20features%20makes%20the%20malware%20much%20harder%20to%20spot%20and%20stop.%22%7D&cd[Meta]=%7B%22title%22%3A%22SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...%22%2C%22meta%3Adescription%22%3A%22New%20Process%20Doppelganging%2C%20obfuscation%20features%20makes%20the%20malware%20much%20harder%20to%20spot%20and%20stop.%22%7D&cd[DataLayer]=%5B%5D&sw=1600&sh=1200&v=2.8.14&r=stable&ec=1&o=28&it=1525943282333&es=automatic
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Thu, 10 May 2018 09:08:02 GMT

GET
H/1.1 200
OK viewport_1.6.js Show response
mcs.eyereturn.com/mcs/ 16 KB
6 KB 27ms
6ms Script
application/x-javascript 2.18.234.44
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://mcs.eyereturn.com/mcs/viewport_1.6.js?bt=saf
Requested by: Host: voken.eyereturn.com
URL: https://voken.eyereturn.com/j4/js?6257264&click=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstDVZZx7TNHKhp-59Poi_6tnZ0IB0tWrbDOxSMivEbQexqCWHPQrI6hmVmneVge24xONyAVfLN03kgXWCrvmUIsZkIkM5mTMXDLpN_vrXFuJKaOuSfmphtJt-ytb66ZKXT5AUc8HseIUUPYNWhdgbw52agtxlyWNRrBE0DpU06sbFdEfSdurpfi3-25-KUTLsio-Xftt48ugF0wUqXMhljuOoRa4a6egLYx5hGAH5T9x7TDYKhXaCh0l7qUuTAuas-2HpCoK4Y9ZbvXnw%2526sai%253DAMfl-YQEFCIp_oINrm6UJgY6WWL_bAiVcqwdDaRVRjiF8fmCsJb0GNXrdo0cwNfJoeCB0g15Rh34GnUi0sicBY2gXixiD5LcDcKJPatPrmAu%2526sig%253DCg0ArKJSzHCWCzC_z6aeEAE%2526urlfix%253D1%2526adurl%253D&params=197645120
Protocol: HTTP/1.1
Server: 2.18.234.44 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: openresty /
Resource Hash: 5dbbc64561a0a4db65fa134f8a7dc741c5dd6d473eb308f9f521acd183327488

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
Server: openresty
Connection: keep-alive
Content-Length: 5827
Vary: Accept-Encoding
Content-Type: application/x-javascript

GET
H/1.1 200
OK baseline
d.ermisvc.com/au2/ 43 B
438 B 407ms
100ms Image
image/gif 69.90.153.133
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d.ermisvc.com/au2/baseline?&id=a4db8267543111e89475c7ba42563525&t=6368390&f=S&vv=0&g=f0591d01-de5b-4fd7-a07b-19833566a38b&dd=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&dr=https%3A%2F%2Ft.co%2FXK6tlvz48H&res=1:54&oid=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

69.90.153.133 New York, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: policyref="http://voken.eyereturn.com/w3c/p3p.xml", CP="NOI DSP NID PSAo PSDa OUR STP IND UNI COM NAV"
Cache-Control: no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK TN_Gartner_research_728x90_v1.jpg
resources.eyereturn.com/api/5036165/ 31 KB
31 KB 24ms
8ms Image
image/jpeg 2.18.234.44
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.eyereturn.com/api/5036165/TN_Gartner_research_728x90_v1.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 2.18.234.44 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: d3a2aef2a7603bb2e8e577d6ac7a96d988ad18636316ecf4995394222446a6da

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:03 GMT
Last-Modified: Thu, 08 Mar 2018 15:52:34 GMT
Server: nginx
ETag: "5aa15c42-7b67"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31591

GET
H/1.1 200
OK ahdim
d.ermisvc.com/au2/ 43 B
438 B 407ms
100ms Image
image/gif 69.90.153.133
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d.ermisvc.com/au2/ahdim?&id=a4db8267543111e89475c7ba42563525&tid=6368390&w=728&h=90

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

69.90.153.133 New York, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: policyref="http://voken.eyereturn.com/w3c/p3p.xml", CP="NOI DSP NID PSAo PSDa OUR STP IND UNI COM NAV"
Cache-Control: no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK rimp
voken.eyereturn.com/j4/ 43 B
341 B 98ms
97ms Image
image/gif 65.39.202.98
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://voken.eyereturn.com/j4/rimp?6257264|6368390&iid=a4db8267543111e89475c7ba42563525
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 65.39.202.98 New York, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Server: nginx
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP NID PSAo PSDa OUR STP IND UNI COM NAV"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43

GET
H/1.1 200
OK viewability
d.ermisvc.com/au2/ 43 B
438 B 407ms
99ms Image
image/gif 69.90.153.133
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d.ermisvc.com/au2/viewability?&id=a4db8267543111e89475c7ba42563525&t=6368390&m=G

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

69.90.153.133 New York, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: policyref="http://voken.eyereturn.com/w3c/p3p.xml", CP="NOI DSP NID PSAo PSDa OUR STP IND UNI COM NAV"
Cache-Control: no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK /
a.ermisvc.com/ts/ 43 B
390 B 542ms
98ms Image
image/gif 66.155.99.59
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.ermisvc.com/ts/?t=6368390&q=1&g=94328315718&iid=a4db8267543111e89475c7ba42563525&oid=&y=1&r=1283375556086.6257
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 66.155.99.59 Atlanta, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:06:26 GMT
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
p3p: p3p: policyref="http://clicks.eyereturn.com/w3c/p3p.xml", CP="NOI DSP PSAa PSDa OUR STP IND UNI COM NAV"
Cache-Control: no-cache
Content-Type: image/gif
Content-Length: 43
Expires: -1

GET
S 200 nav-background.png
img.deusm.com/darkreading/ 3 KB
3 KB 9ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/nav-background.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Sat, 22 Feb 2014 17:43:38 GMT
server: cloudflare
etag: "af8-4f30247448680"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fcd986349-FRA
content-length: 2808

GET
S 200 reb-border.png
img.deusm.com/darkreading/ 331 B
430 B 9ms
8ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/reb-border.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Thu, 03 Nov 2016 06:29:01 GMT
server: cloudflare
etag: "14b-5405fac56e540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fdd9a6349-FRA
content-length: 331

GET
S 200 facebook-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 10ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/facebook-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "4a9-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fdd9b6349-FRA
content-length: 1193

GET
S 200 tw-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 9ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/tw-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "56e-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fdd9c6349-FRA
content-length: 1390

GET
S 200 li-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 127ms
127ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/li-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "54b-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fdd9d6349-FRA
content-length: 1355

GET
S 200 google-icon.png
img.deusm.com/darkreading/ 2 KB
2 KB 20ms
20ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/google-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2014095de604ead647724ba4b12e37e2f4b2510dc2b2d13f749d38e314dbab2a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:46 GMT
server: cloudflare
etag: "63b-4f32913120780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fdd9e6349-FRA
content-length: 1595

GET
S 200 rss-icon.png
img.deusm.com/darkreading/ 2 KB
2 KB 9ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/rss-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "649-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b424fdd9f6349-FRA
content-length: 1609

GET
S 200 BngRUXZYTXPIvIBgJJSb6u92w7CGwRg.ttf
fonts.gstatic.com/s/robotoslab/v7/ 36 KB
22 KB 6ms
6ms Font
font/ttf 172.217.23.131
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v7/BngRUXZYTXPIvIBgJJSb6u92w7CGwRg.ttf

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.23.131 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s18-in-f3.1e100.net

Software

sffe /

Resource Hash

fec00dfd52d9312fbd52cc2aa8261734e2da0be4eddd885275d6d4ba9e6f231b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab:700
Origin: https://www.darkreading.com

Response headers

date: Thu, 08 Feb 2018 23:24:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7811008
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 22399
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Oct 2017 18:27:21 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Feb 2019 23:24:35 GMT

GET
H/1.1 200
OK secureAnonymousFramework Show response
platform.linkedin.com/js/ 156 KB
45 KB 6ms
6ms Script
text/javascript 192.229.133.150
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/js/secureAnonymousFramework?v=1.0.281-1429&
Requested by: Host: platform.linkedin.com
URL: https://platform.linkedin.com/in.js
Protocol: HTTP/1.1
Server: 192.229.133.150 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41EC) /
Resource Hash: a4c6710ffa2f294e54b88e2280010fe6a2cce42ec32dd0b57df821fd41eb0539

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV4
X-CDN: ECST
X-Cache: HIT
X-CDN-Proto: HTTP1
Content-Length: 45458
X-LI-UUID: 3SIPsB1dLBXgSH4UZSsAAA==
Server: ECS (fcn/41EC)
Last-Modified: Mon, 07 May 2018 12:38:58 GMT
X-Li-Pop: prod-efr5-icwd20
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-lva1
Expires: Fri, 10 May 2019 09:08:03 GMT

GET
S 200 plusone.js Show response
apis.google.com/js/ 43 KB
17 KB 68ms
55ms Script
application/javascript 172.217.21.238
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.21.238 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

cbff3fe2f2b700b8c95add310833153826769b3eb5c8e8d2bb2f1b22079125ed

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180508.12_p0
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

content-security-policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180508.12_p0
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
date: Thu, 10 May 2018 09:08:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "3a3cb40e4d26e76abfcb10a2ef9616f5"
timing-allow-origin: *
expires: Thu, 10 May 2018 09:08:03 GMT

GET
S 200 bullet.png
img.deusm.com/informationweek/ 1 KB
1 KB 10ms
10ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/bullet.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Sat, 02 Nov 2013 00:57:26 GMT
server: cloudflare
etag: "41e-4ea272a96e980"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b42500dcf6349-FRA
content-length: 1054

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
56 B 17ms
17ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstaVfXZinbdlIuufUPGCE5QE2f_yeAwBxauToBPE4ukLjtB2z3UulFUNgSJdTttR_AMsvSAVhkG5ksnSBjciVGdW2P_Hg7DNj6NZrV336SX6RSRSth3-fUfIC4MN0VuEnt-Fl2yTuZEqc4WIuOUyNuzUVsIXUa-XSCTwHN_FCdOas9zGK2TrTk4YQvZM_m6KDqbP71u0oX3D0qQRU3GdWZovzg4wmzupjJDN78VqG0GegOVMy0AqkLpdHm0pp9Re1DqVzBg6CSAwTY9jv-P&sai=AMfl-YTOjLYHdObkbEYHzw2kJWn7arKPs5wdr-N9o4yiUPfAyc4vhHF080gKCg-_GN9c0ES_rn-GESVcJ4xVbbk_94hr1SPr_jYdo1vrtjTX&sig=Cg0ArKJSzJAeQHMhG97hEAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK index.html
players.brightcove.net/1568176135/H1b5TdnsOg_default/ Frame 0DD5 0
0 157ms
11ms Document
text/html 2.18.234.122
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://players.brightcove.net/1568176135/H1b5TdnsOg_default/index.html?videoId=5772593446001
Requested by: Host: i.ubm-us.net
URL: https://i.ubm-us.net/oas/nativead/js/dr_nativead.js?v3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.122 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Host: players.brightcove.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

x-amz-id-2: rmu6p3bLOe/EnwXtzZJeGfB8m4AFAS4vP8luBFambtcM0Lao5FXDcGmi//+GpaY++tonLbnhEn8=
x-amz-request-id: 866BB98B256074B9
x-amz-replication-status: COMPLETED
Last-Modified: Tue, 13 Mar 2018 15:37:05 GMT
ETag: "06174dc94ce5143f9f427a16b903cc3b"
Content-Encoding: gzip
x-amz-version-id: 5vsq0AybbUx02DFE.cknKfpP9znLkxsx
Server: AmazonS3
Content-Length: 157971
Accept-Ranges: bytes
X-Served-By: cache-fra19149-FRA
X-Cache-Hits: 1
X-Timer: S1524672287.426129,VS0,VE1
Vary: Accept-Encoding
X-BCOV-Response-Mode: 1
Cache-Control: public, max-age=290
Date: Thu, 10 May 2018 09:08:03 GMT
Connection: keep-alive
Content-Type: text/html; charset=utf-8

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
56 B 38ms
36ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsva1uTin3Yh1zBL1_QxvRRKUIEorkeLv9S33h-uMzQrD9dR9R7JCnYNp4f_R3pdW4TXbbQ1KXvqc5plgDjlsVzBT1fLNW1Lw3J29mJIZm_5rF1ua01EN4v0wXW4fH62_cNPiwd66ZgIBt5NyVSWaKvArVtVC1meXBlgBZcqqgSTRrm-XX6kY315vt70o9GNjniJPQzjqqMYSTgsWIFnCBaMX3hIBNVAKu8hFoNAK8ix-JvNnBNg4IjGOkJ486gqBYYvtE-g1hXxpyaFmfIK&sai=AMfl-YTcjVgEQ7gb2wHv6sM8d-Ow9vKQ92FjeLDYcksOhL0dlbS5EXfeIJn_Xwkd9BVk3vGX6GbYQ2EgTLWQan8TYgEALsZC7I_YOx76Szqx&sig=Cg0ArKJSzBAXmw6HA4OrEAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK view
d.ermisvc.com/au2/ 43 B
438 B 387ms
97ms Image
image/gif 69.90.153.133
Cogeco Peer 1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d.ermisvc.com/au2/view?&id=a4db8267543111e89475c7ba42563525&m=G

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

69.90.153.133 New York, United States, ASN13768 (COGECO-PEER1 - Cogeco Peer 1, CA),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: policyref="http://voken.eyereturn.com/w3c/p3p.xml", CP="NOI DSP NID PSAo PSDa OUR STP IND UNI COM NAV"
Cache-Control: no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK sprite_connect_v14.png
static.licdn.com/scds/common/u/images/apps/connect/sprites/ 41 KB
41 KB 26ms
6ms Image
image/png 192.229.233.180
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.licdn.com/scds/common/u/images/apps/connect/sprites/sprite_connect_v14.png
Requested by: Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/osd_listener.js
Protocol: HTTP/1.1
Server: 192.229.233.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41AD) /
Resource Hash: 2d7481c72a3827dee23254b8198fa70f7ce5c637791658b4e0c6550a568af105

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV4
X-CDN: ECST
X-Cache: HIT
X-CDN-Proto: HTTP1
Content-Length: 41680
X-LI-UUID: scJvXeHD1BRAYkJCQysAAA==
Server: ECS (fcn/41AD)
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-edc2
Cache-Control: max-age=31536000, immutable
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
Accept-Ranges: bytes
X-LI-Static-Content: 1
X-Li-Fabric: prod-ltx1
Expires: Wed, 25 Jul 2018 21:01:59 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
56 B 42ms
41ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskKED5KB71JI66rV3sQhL8DSQ-2lOE26LGmoFzBAb8X48UTZwxIl6pCdAgdoWf3C8KtG4k67PBquBUka6mp0cCl5ud1Wh_OVxYNpAf_86JGh4z-p_BOarnlaTyZj0fTDmEWkHS3qtkq1oiOpM3jLXYTeTOjUBqQRuiQJA42zcFxPOFDNlzjVO1laufDLCH2DY2aLpI-sktNPR0xiaTkT8eliC-Do_MgDsmcm8wQnnwi4hGJYE6ffs4MIHhNuaQJ2Qx9tuiraoSq85RAYxyaw&sai=AMfl-YR7CMFXWNgu1MXwiTY25RyOoAEpqem8aYBgFZUhxWL2JB1Xpn_9c_ejE-6Mc5fqdApjtYcrzDETT7tPtWSDRjTvJD8Ds4g49PBiD-0-&sig=Cg0ArKJSzEemotJ56ZhxEAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
110 B 15ms
15ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvUWJ4W5FZ3Bj8rsu5hqy5vzW24YOQJiNjAsRDkIMoL1EtPXE84hz4L7_ZRCI9BgiR6tNLl3Xe3qZWCUoqE6kX202PHPu2Dvyg&sig=Cg0ArKJSzE7wtRk0toXcEAE&id=osdim&ti=1&r=z&adk=770981021&tt=543&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,1585&mraid_race=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1600,1200&ss=1600,1200&pt=-1&deb=1-0-3-5-5--1-2-2&tvt=531&op=1&uc=1&tgt=DIV&cl=1&cec=5&clc=0&cac=0&cd=1585x0&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
178 B 14ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstOBHzTYjvFNeV2I1dArYC2lz3CTJ9MzzLv_CooRPLtYfoToCUaJQ_f1fjCLCggZX8iOTyOmdmhFbPwMBgocpSCJh8VenvUegM&sig=Cg0ArKJSzHr4feemFNGNEAE&id=osdim&ti=1&r=z&adk=2332965166&tt=543&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,1585&mraid_race=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1600,1200&ss=1600,1200&pt=-1&deb=1-0-3-5-5--1-2-2&tvt=531&op=1&uc=1&tgt=DIV&cl=1&cec=6&clc=0&cac=0&cd=1585x0&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.OUyeeXIQL6o.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng/ 131 KB
46 KB 6ms
6ms Script
text/javascript 172.217.21.238
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.OUyeeXIQL6o.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

SPDY

Server

172.217.21.238 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d56869aa37b3a2b86a60c228065dcd286ca3b449cf8c024b4caaf202d346b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Wed, 09 May 2018 22:59:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 May 2018 21:43:18 GMT
server: sffe
age: 36514
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 46575
x-xss-protection: 1; mode=block
expires: Thu, 09 May 2019 22:59:29 GMT

GET
S 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.OUyeeXIQL6o.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng/ 97 KB
34 KB 9ms
9ms Script
text/javascript 172.217.21.238
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.OUyeeXIQL6o.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

SPDY

Server

172.217.21.238 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

689c5221a9a0bf4d6372efbb9c2aa8e0f6a850dd4a719013430c2fbddf8f6058

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Wed, 09 May 2018 22:59:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 May 2018 21:43:18 GMT
server: sffe
age: 36512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 34942
x-xss-protection: 1; mode=block
expires: Thu, 09 May 2019 22:59:31 GMT

GET
H2 200 fastbutton
apis.google.com/se/0/_/+1/ Frame 9919 0
0 28ms
25ms Document
text/html 172.217.21.238
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.darkreading.com&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.OUyeeXIQL6o.O%2Fm%3D__features__%2Fam%3DAQE%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.217.21.238 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180507.12_p0
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: apis.google.com
:scheme: https
:path: /se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.darkreading.com&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.OUyeeXIQL6o.O%2Fm%3D__features__%2Fam%3DAQE%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
cookie: NID=129=mlxl1pLW96owvKfLOP31tTvPqJCofk99i5h1QJ5zqP5nAiDb6Pk2mPMiNqHZjlvTX00P2XOK-Jx0lOjbucecvpFgRVXr8SG-s6aiBlKWRtzCSvn6iqZhSbZJdpXNVnWH
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
content-type: text/html; charset=utf-8
content-security-policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180507.12_p0
x-ua-compatible: IE=edge, chrome=1
vary: Accept-Encoding
timing-allow-origin: *
expires: Thu, 10 May 2018 09:08:03 GMT
date: Thu, 10 May 2018 09:08:03 GMT
cache-control: private, max-age=3600
content-encoding: gzip
server: ESF
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"

GET
H/1.1 200
OK web.js Show response
ads.celtra.com/4278f865/ 10 KB
4 KB 410ms
109ms Script
application/javascript 34.231.151.207
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.celtra.com/4278f865/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssMUXeuNvr7aYUnYmQyA6wdDpOokjhgIwDsAxVrA-g80G28bG4b2-4xcA2HNhWAjWhHJyAHLNBO6HxykXN895EeuZFSvItCIQqxnO35uLzVu9gW4hrklirzADg7YZoLkgOrsz72QPLNzaBvCQI66hHHm-9LIJf_G0Kecefcmo0YPmjYDTXd2fM8gAUn2s4DhzqySkc3LqKjwwM9BuXxf9kmUvbxmzJWME_hRIizOKpW4NAfWlbNPUsypGFV_8K4GL5bFZfe6R7x66lsCw%26sai%3DAMfl-YRWXjIK2mCJtxcktG0r0kL1tiqbfbpwq0tDMLxbc5cNND94eE5hkuDtZXuihiVjTd9RJf4sT7bUmvzPKwac8u-tEKa1ISJpfI0JMaSZ%26sig%3DCg0ArKJSzCBTB6sXL53xEAE%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=6&externalCreativeId=138232753628&externalPlacementId=43863396&externalSiteId=27868836&externalSiteName=darkreading.com&externalLineItemId=4461146792&externalCampaignId=2167178795&scriptId=celtra-script-1&clientTimestamp=1525943283.323&clientTimeZoneOffsetInMinutes=0&hostPageLoadId=6175037021895966
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 34.231.151.207 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-231-151-207.compute-1.amazonaws.com
Software: /
Resource Hash: 39b20ce42cde60d540f6a5770dbe6cb5ead00161956a03626e9972330c08b6af

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
Content-Type: application/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 3561
Expires: 0

GET
S 200 m_window_focus_non_hydra.js Show response
tpc.googlesyndication.com/pagead/js/r20180507/r20110914/client/ext/ Frame AAA9 3 KB
1 KB 6ms
5ms Script
text/javascript 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180507/r20110914/client/ext/m_window_focus_non_hydra.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

83f2c74ec2fb928d79e5b1e6c8313b9b3f4af3bed14fbc850dff3edffb3f44d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Wed, 09 May 2018 03:53:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105296
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1411
x-xss-protection: 1; mode=block
server: cafe
etag: 14617486786606014518
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 May 2018 03:53:07 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/ Frame AAA9 70 KB
0 6ms
6ms Script
text/javascript 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

8ce91b441f5986df8dcfb08b25e85caa723a8140e765458da08c62c8ba14173f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 07 May 2018 21:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213940
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 25838
x-xss-protection: 1; mode=block
server: cafe
etag: 1784613934527904873
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 May 2018 21:42:22 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame AAA9 0
47 B 21ms
20ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv1NMHVqELnDfTmDDQW6e6E3X-i0YBgEwMKCXwje2WnxPWHDmAb6qWXPhzZ25T-pnkIlAeFy9trQirkSYigl_pT0Ev6EZG0Sz1sbtScgxW4rpuLsAuDGqbaYl-54JKSdJTJ3SEDBv6PEFrcan5GGAGMqIX79Z9igSOz_DLsXcI5uJhmp8N7WgnIcQP-OpZSGEWl_tBh6Lz0xcbSFpFiqjjdDcqInYT43V6XVmj3e11-vhTbuBJpD3jbeUQkuo0mzfH7wxPjpx4GovDCCTLWtQ&sai=AMfl-YSJhNLZdMlgcNlQwqHtnSmL9flCTmAZKjneG01SeN1zdGVgn0e5YEkqEBdytYDwg6sSj9NsKYPfFdcTnmFrDxAlq3XrOmplkgdByn4c&sig=Cg0ArKJSzEHRNOynqzGIEAE&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
S 200 17938399188122601646
tpc.googlesyndication.com/simgad/ Frame AAA9 38 KB
38 KB 11ms
11ms Image
image/jpeg 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17938399188122601646

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s13-in-f237.1e100.net

Software

sffe /

Resource Hash

91f677125ca33dd41ec01df53a044ca21d7829480d058670d0e64292360670a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Mon, 30 Apr 2018 07:19:23 GMT
x-content-type-options: nosniff
age: 870520
x-dns-prefetch-control: off
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 39088
x-xss-protection: 1; mode=block
last-modified: Fri, 02 Mar 2018 17:05:20 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 Apr 2019 07:19:23 GMT

GET
S 200 DR-hot-topics-comment.png
img.deusm.com/darkreading/ 1 KB
1 KB 9ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-hot-topics-comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9182e8a1e20a5437d2f311b096b2a98a33d54e94d4d9d6d01c5db3861460d04e

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:02 GMT
server: cloudflare
etag: "4a5-4f2ebd20ac480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b42514e756349-FRA
content-length: 1189

GET
S 200 NL-button.png
img.deusm.com/informationweek/ 2 KB
3 KB 9ms
9ms Image
image/png 104.24.112.55
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/NL-button.png
Requested by: Host: mcs.eyereturn.com
URL: https://mcs.eyereturn.com/mcs/viewport_1.6.js?bt=saf
Protocol: SPDY
Server: 104.24.112.55 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2013 15:09:43 GMT
server: cloudflare
etag: "9c6-4eaabc5a3dbc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 418b42515e7f6349-FRA
content-length: 2502

GET
H2 200 postmessageRelay
accounts.google.com/o/oauth2/ Frame 4E59 0
0 42ms
18ms Document
text/html 172.217.21.237
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.darkreading.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.OUyeeXIQL6o.O%2Fm%3D__features__%2Fam%3DAQE%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.OUyeeXIQL6o.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng/cb=gapi.loaded_1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.217.21.237 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dlJUaYY0+OV1c6FEdLjWNsfNYx4' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'none';report-uri /o/cspreport
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.darkreading.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.OUyeeXIQL6o.O%2Fm%3D__features__%2Fam%3DAQE%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMig7Cl8NKBoFKuFu2nMRb3qr5wng
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
cookie: NID=129=mlxl1pLW96owvKfLOP31tTvPqJCofk99i5h1QJ5zqP5nAiDb6Pk2mPMiNqHZjlvTX00P2XOK-Jx0lOjbucecvpFgRVXr8SG-s6aiBlKWRtzCSvn6iqZhSbZJdpXNVnWH
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 10 May 2018 09:08:03 GMT
content-security-policy: script-src 'report-sample' 'nonce-dlJUaYY0+OV1c6FEdLjWNsfNYx4' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'none';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 1; mode=block
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"

GET
S 200 m_window_focus_non_hydra.js Show response
tpc.googlesyndication.com/pagead/js/r20180507/r20110914/client/ext/ Frame 40C7 3 KB
0 6ms
5ms Script
text/javascript 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180507/r20110914/client/ext/m_window_focus_non_hydra.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

83f2c74ec2fb928d79e5b1e6c8313b9b3f4af3bed14fbc850dff3edffb3f44d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 09 May 2018 03:53:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105296
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1411
x-xss-protection: 1; mode=block
server: cafe
etag: 14617486786606014518
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 May 2018 03:53:07 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/ Frame 40C7 70 KB
0 6ms
6ms Script
text/javascript 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180507/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_203.js

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

8ce91b441f5986df8dcfb08b25e85caa723a8140e765458da08c62c8ba14173f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 07 May 2018 21:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213940
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 25838
x-xss-protection: 1; mode=block
server: cafe
etag: 1784613934527904873
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 May 2018 21:42:22 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame 40C7 0
47 B 18ms
17ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssasfV46O1jhsiCHc5305crhXk1CpYQDDh9lTyPcFeqCestV5hSiqG4HoWyAMFL7vddbbTnYjgWv8iYOMupdeqrQzLIoYNHnDCAqRbUolZUfhGRdoGqR9qNv8wG6-s-LgYKKAKE6p4_QM2pQUjgziaWU4D1EqZAujjcwanjAKyeGROrAfIJinOBDsBzh3KFTwuFuhmcQ1kN7tT41mPx2t8XVnVJhd7bLWaIZzCJAavgnySvRyRQbfho-jXrAbmeL2ojQhvAbEHHjBOs&sai=AMfl-YSyjs_K9MzXoAOydlUU12agXy1qACXVjWzE1XJajcZls67BlwY0XqU-cKdZExu2XJTl7V3N1mn6URJA_PSU614w3H1GuCDnfwxNb6iG&sig=Cg0ArKJSzOVCQ6T7zzyuEAE&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
S 200 6112932644020548289
tpc.googlesyndication.com/simgad/ Frame 40C7 59 KB
59 KB 7ms
7ms Image
image/png 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6112932644020548289

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

a23-38-61-244.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

56905a3340353833b160c4b9243759d7e146de644825d737431e2921a4e173f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Wed, 09 May 2018 16:08:37 GMT
x-content-type-options: nosniff
age: 61166
x-dns-prefetch-control: off
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 60007
x-xss-protection: 1; mode=block
last-modified: Wed, 09 May 2018 15:51:58 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 May 2019 16:08:37 GMT

GET
H/1.1 200
OK tag Show response
a.teads.tv/page/11512/ 1 KB
1 KB 132ms
43ms Script
application/javascript 54.77.236.13
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/11512/tag
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_203.js
Protocol: HTTP/1.1
Server: 54.77.236.13 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-77-236-13.eu-west-1.compute.amazonaws.com
Software: teads-ssp /
Resource Hash: 57d73d9916fd4cad4a66b5c8b61626ed5d6b02d1949016e38a31cde654fe13e0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
Server: teads-ssp
transfer-encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: 0

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ 0
47 B 20ms
19ms Image
text/html 172.217.18.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGcL_fjASi1Zsrm4ZOB6WP5SrZc_pLeNLGwBYtcehHrRaX840SOAg4Rqj4gCEAhbf1XtbIKIW1NK-6C9EJ2cMJwL0Gmvx5z_5hsJMT1XdqcfhicXMkV9O28Zlo3blBkK6NJrtaAk7yumOeyA9Uc6qioBpcUzKkaTaI3RWJjxgZkbPlaNfVHdiJAyyvjJcvqcuraZ8jkZL4kgTyJFmJGix-gHsap5NaanhuhDMNvdqvYuAchkrzp7DfjpcrOgl0VxfZ3HP6nI09hXs&sai=AMfl-YRAnqksrLlXbs9IRfEc9hrt14HlkcZ7MFtEKiby6Z0mz9e0BFmDFQhf1QsBRJZo4F4h5F-n5AAykIyQIL0lUEtGjlCmoQEAT0qz-SPB&sig=Cg0ArKJSzFHE4cV5e4V4EAE&urlfix=1&adurl=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 172.217.18.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control: private
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK s13879309447590
ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/ 43 B
520 B 24ms
23ms Image
image/gif 172.82.228.18
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/s13879309447590?AQB=1&ndh=1&pf=1&t=10%2F4%2F2018%209%3A8%3A3%204%200&sdid=275191D4497C2ACC-619DCE6A898B00A4&mid=77239913704263148722690152409043453916&aid=2D7A05F885316D44-60000117200F8FA1&aamlh=9&ce=UTF-8&ns=ubmtech&pageName=darkreading.com%20attacks%2Fbreaches%20jai%20vijayan%20synack%20ransomware%20gets%20dangerous%20%27doppleganging%27%20feature&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&r=https%3A%2F%2Ft.co%2FXK6tlvz48H&cc=USD&events=event5&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&h1=Dark%20Reading%7CAttacks%2FBreaches&c2=1331736&v2=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20...&c3=Dark%20Reading%20%7C%201331736%20%7C%20SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20Feature&c4=SynAck%20Ransomware%20Gets%20Dangerous%20%27Doppleganging%27%20Feature&c5=Attacks%2FBreaches%20-%20Attacks%2FBreaches&c7=Jai%20Vijayan&c8=148.251.45.254%20%7C%20Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20HeadlessChrome%2F66.0.3359.139%20Safari%2F537.36&v10=thursday%7C5%3A00am&c11=News%20Analysis&v12=1331736&c13=thursday%7C5%3A00am&v13=www.darkreading.com&v15=First%20Visit&c17=New&v17=New&c19=Un-Registered&c20=20180507&c22=First%20Visit&c23=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&v28=Jai%20Vijayan&v37=News%20Analysis&c41=4&c48=1&v48=1&c50=2.8.2&v61=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&AQE=1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 172.82.228.18 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.d3.sc.omtrdc.net
Software: Omniture DC /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Last-Modified: Fri, 11 May 2018 09:08:03 GMT
Server: Omniture DC
xserver: www185
ETag: "3276938248105033728-6106389712338485258"
Vary: *
X-C: ms-6.2.1
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 May 2018 09:08:03 GMT

GET
S 200 boomerang.min.js Show response
cdn.feathr.co/js/ 63 KB
20 KB 57ms
14ms Script
text/javascript 104.25.248.99
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.feathr.co/js/boomerang.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 104.25.248.99 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 602190934ea21c08adb7c4fbbe138db22df5520e67d1cca50e738d970969708c

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 09 May 2018 22:45:21 GMT
server: cloudflare
x-amz-request-id: 043CFD1A43230436
etag: W/"23d7c9aaca6e7593ac646f727a77ab40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 418b42534d366379-FRA
x-amz-id-2: OZvImgCcrV/icQAVsHcZNdxS45++xvxMzavQg087ZXnP7IOqjWfmfYCxHU46gQhZPVtlhcgyLgk=
expires: Thu, 10 May 2018 13:08:03 GMT

GET
H/1.1 200 Cookie set login.jsp
ng.techweb.com/authds/login/ Frame AB62 0
0 637ms
125ms Document
text/html 192.155.48.119
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Requested by: Host: twimgs.com
URL: https://twimgs.com/nojitter/js/jquery-1.11.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.155.48.119 New Hyde Park, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS: tw-ngprod-http-redirect-virt.ubm-us.net
Software: NG /
Resource Hash

Request headers

Host: ng.techweb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Accept-Encoding: gzip, deflate
Cookie: Insights=38-bd82faa5-fef3-48e8-a302-884a9e4b6cd8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

Set-Cookie: JSESSIONID=6F984C32A1FFCD5D979249789F6DA3D3; Path=/; Secure; HttpOnly
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 759
Vary: Accept-Encoding
Date: Thu, 10 May 2018 09:08:04 GMT
Server: NG
Content-Encoding: gzip
Connection: Keep-Alive

GET
H2 200 ping
www.facebook.com/connect/ Frame 2070 0
0 45ms
45ms Document
text/html 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/connect/ping?client_id=640989409269461&domain=www.darkreading.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FRQ7NiRXMcYA.js%3Fversion%3D42%23cb%3Df13b6079182627%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff2914ec822325e4%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /connect/ping?client_id=640989409269461&domain=www.darkreading.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FRQ7NiRXMcYA.js%3Fversion%3D42%23cb%3Df13b6079182627%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff2914ec822325e4%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
cookie: fr=0P3wBmUslZyhIth4U..Ba9Avy...1.0.Ba9Avy.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
x-xss-protection: 0
pragma: no-cache
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
cache-control: private, no-cache, no-store, must-revalidate
expect-ct: max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8
x-fb-debug: r3sRb3iuyhsgrOJMCeCDzAaUKlIPBmsUgk7EjMfP8Yh48SU3SI13QkWwyJUI1ojh6dKSHogKYS69PaB1xx1GKg==
date: Thu, 10 May 2018 09:08:03 GMT

GET
H2 200 widget_iframe.d383dc1d510865aceaa5e552afcf5663.html
platform.twitter.com/widgets/ Frame 2892 0
0 7ms
6ms Document
text/html 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.d383dc1d510865aceaa5e552afcf5663.html?origin=https%3A%2F%2Fwww.darkreading.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/widget_iframe.d383dc1d510865aceaa5e552afcf5663.html?origin=https%3A%2F%2Fwww.darkreading.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
date: Thu, 10 May 2018 09:08:03 GMT
last-modified: Mon, 07 May 2018 21:48:23 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "fbca609ced8e558319180092b6f196eb+gzip"
content-encoding: gzip
accept-ranges: bytes
via: 1.1 varnish
age: 212701
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
x-cache: HIT
x-timer: S1525943284.734715,VS0,VE0
vary: Accept-Encoding,Host
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 5846

GET
S 200 timeline.e7653a8bc8be5342f5ecf22ae2e65c92.js Show response
platform.twitter.com/js/ 26 KB
8 KB 7ms
6ms Script
application/javascript 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.e7653a8bc8be5342f5ecf22ae2e65c92.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: d77bc1018a13b0b64284086c8cfa0f44e649a02833bbd7dcbdf869a42af95f05

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
content-encoding: gzip
age: 212701
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 8517
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
last-modified: Mon, 07 May 2018 21:48:18 GMT
x-timer: S1525943284.736579,VS0,VE0
etag: "32472870e6511fb800f980c5ab4e58f6+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes

GET
S 200 button.7db838345f9545c91ea4497f64abb814.js Show response
platform.twitter.com/js/ 4 KB
1 KB 7ms
6ms Script
application/javascript 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.7db838345f9545c91ea4497f64abb814.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: f28622f939416ae1b803ae820fb5c9605b91057f2b88b571f61236969aa1a41a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
content-encoding: gzip
age: 212702
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1394
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
last-modified: Mon, 07 May 2018 21:48:18 GMT
x-timer: S1525943284.738296,VS0,VE0
etag: "8acfe6fdaf660e4040ed80fc61fd875d+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes

GET
H/1.1 204
No Content record.do
ins.techweb.com/beacon/ Frame D6A3 0
0 119ms
113ms Document
text/plain 192.155.48.48
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.techweb.com/beacon/record.do?a=bfb712d4d19ed922a019f653ef0d27df3e8dac70570cb4ba0be8b5d8c49e00ac&u=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fsynack-ransomware-gets-dangerous-doppleganging-feature%252Fd%252Fd-id%252F1331736%253F&t=P
Requested by: Host: ins.techweb.com
URL: https://ins.techweb.com/beacon/js/beacon-min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.155.48.48 New Hyde Park, United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS: ins.techweb.com
Software: INS /
Resource Hash

Request headers

Host: ins.techweb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Accept-Encoding: gzip, deflate
Cookie: Insights=38-bd82faa5-fef3-48e8-a302-884a9e4b6cd8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

P3P: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
Date: Thu, 10 May 2018 09:08:03 GMT
Server: INS

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 39ms
6ms Script
application/x-javascript 23.38.61.244
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: twimgs.com
URL: https://twimgs.com/informationweek/elqNow/elqImg.js

Protocol

HTTP/1.1

Server

23.38.61.244 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

23818277c974e4ed1d48a04077c6a133bde3435f3d0bafe8dcca49150ebcb986

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=3600; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 30 Jan 2018 23:49:04 GMT
ETag: "e82f16e9249ad31:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA"
Cache-Control: no-cache, no-store
Date: Thu, 10 May 2018 09:08:03 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2118
Expires: Thu, 10 May 2018 09:08:03 GMT

GET
H2 200 like.php
www.facebook.com/plugins/ Frame 2D9E 0
0 73ms
66ms Document
text/html 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FRQ7NiRXMcYA.js%3Fversion%3D42%23cb%3Dffa825a352003%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff2914ec822325e4%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FRQ7NiRXMcYA.js%3Fversion%3D42%23cb%3Dffa825a352003%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff2914ec822325e4%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
cookie: fr=0P3wBmUslZyhIth4U..Ba9Avy...1.0.Ba9Avy.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
timing-allow-origin: *
x-xss-protection: 0
pragma: no-cache
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
cache-control: private, no-cache, no-store, must-revalidate
expect-ct: max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8
x-fb-debug: iRyhNhOvK2zWUluSDovecqasoBjvJeog9n9nRrAksd/NW7qUIC8Q+eS+RsYBeIJPL55NOK34+FFhyZ83Q6gUbw==
date: Thu, 10 May 2018 09:08:03 GMT

GET
H/1.1 200
OK teads-format.min.js Show response
cdn.teads.tv/media/format/v3/ 623 KB
162 KB 25ms
6ms Script
text/javascript 2.18.234.227
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/page/11512/tag
Protocol: HTTP/1.1
Server: 2.18.234.227 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: de017f266b2b1c835f2c023fb84c8d54083be0c5f8ee4087df6af26c58eed690

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 May 2018 09:09:13 GMT
Server: AmazonS3
x-amz-request-id: 208A49508D4EC198
ETag: "291bb5c953b2a773515daaf79ca29f7c"
Vary: Accept-Encoding
Content-Type: text/javascript;charset=utf-8
Cache-Control: max-age=268
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 165307
x-amz-id-2: yCYi7LqX+iLtCk9cyXIHBa4m6OYO6XcW7H3x+uQvxDkJtRPo5rVsnKITewPZWfYWtgSvLYzcHkk=

GET
S 200 web.js Show response
cache-ssl.celtra.com/api/creatives/2650a6f3/compiled/ 511 KB
112 KB 159ms
54ms Script
application/javascript 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cache-ssl.celtra.com/api/creatives/2650a6f3/compiled/web.js?v=13-7877a55061&secure=1&inmobi=0
Requested by: Host: ads.celtra.com
URL: https://ads.celtra.com/4278f865/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssMUXeuNvr7aYUnYmQyA6wdDpOokjhgIwDsAxVrA-g80G28bG4b2-4xcA2HNhWAjWhHJyAHLNBO6HxykXN895EeuZFSvItCIQqxnO35uLzVu9gW4hrklirzADg7YZoLkgOrsz72QPLNzaBvCQI66hHHm-9LIJf_G0Kecefcmo0YPmjYDTXd2fM8gAUn2s4DhzqySkc3LqKjwwM9BuXxf9kmUvbxmzJWME_hRIizOKpW4NAfWlbNPUsypGFV_8K4GL5bFZfe6R7x66lsCw%26sai%3DAMfl-YRWXjIK2mCJtxcktG0r0kL1tiqbfbpwq0tDMLxbc5cNND94eE5hkuDtZXuihiVjTd9RJf4sT7bUmvzPKwac8u-tEKa1ISJpfI0JMaSZ%26sig%3DCg0ArKJSzCBTB6sXL53xEAE%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=6&externalCreativeId=138232753628&externalPlacementId=43863396&externalSiteId=27868836&externalSiteName=darkreading.com&externalLineItemId=4461146792&externalCampaignId=2167178795&scriptId=celtra-script-1&clientTimestamp=1525943283.323&clientTimeZoneOffsetInMinutes=0&hostPageLoadId=6175037021895966
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: f001732d777885de6d43c23f6570778a0abcd0a655d7ba365e4cb4133553748f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 08:30:56 GMT
content-encoding: gzip
age: 2226
x-cache: Hit from cloudfront
status: 200
content-length: 113629
access-control-allow-origin: *
server: Apache
etag: "2a54f12a9f39e8712eeb71c4291be481680d70f10c5642a6c01a4bab4c9bb3a8"
vary: Accept-Encoding
x-varnish: 96017064
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: UK9lGxUAMPPQa3FdwWdkv8Tiq6kDAgsCmAQhUFvZ-AWRob3YWSgjaQ==

OPTIONS
H/1.1 200
OK 5772dda68e8027153edc8f4f Show response
polo-v1.feathr.co/v1/analytics/version/ 0
413 B 434ms
104ms Fetch
text/html 23.21.80.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://polo-v1.feathr.co/v1/analytics/version/5772dda68e8027153edc8f4f
Requested by: Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol: HTTP/1.1
Server: 23.21.80.160 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-23-21-80-160.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: GET
Origin: https://www.darkreading.com
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Thu, 10 May 2018 09:08:04 GMT
Allow: HEAD, OPTIONS, GET
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 0

GET
H/1.1 200
OK integrations Show response
polo-v1.feathr.co/v1/accounts/5772dda68e8027153edc8f4f/ 78 B
501 B 466ms
112ms Fetch
application/json 23.21.80.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://polo-v1.feathr.co/v1/accounts/5772dda68e8027153edc8f4f/integrations
Requested by: Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol: HTTP/1.1
Server: 23.21.80.160 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-23-21-80-160.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: c4f6329bc974f1841fe8e0e46b2dde56ee45571ec047494462fac2d6e3f3e8ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com

Response headers

Date: Thu, 10 May 2018 09:08:04 GMT
Content-Encoding: gzip
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: Accept-Encoding,User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 82

GET
S 200 refresh
marco.feathr.co/v1/ 43 B
540 B 531ms
139ms Image
image/gif 13.32.121.150
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marco.feathr.co/v1/refresh
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.150 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-150.prg50.r.cloudfront.net
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
via: 1.1 6cb78296671f58336aec660457ced456.cloudfront.net (CloudFront)
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key
x-amzn-requestid: a58caa94-5431-11e8-b208-87d3f5106cf4
status: 200
access-control-allow-methods: *
content-type: image/gif
access-control-allow-origin: *
x-amzn-trace-id: Root=1-5af40bf4-54494cedee6db42acd1a5c27
x-cache: Miss from cloudfront
x-amz-apigw-id: GqbOKGtaoAMFxTQ=
content-length: 43
x-amz-cf-id: ytWW64eoPIpyoz1eu5cE51GYssS0FXkjW50md2i7dRYFbxbxgcIMQw==

GET
H/1.1 200
OK 441964414116179968 Show response
cdn.syndication.twimg.com/widgets/timelines/ 149 KB
11 KB 367ms
367ms Script
application/javascript 68.232.35.172
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/widgets/timelines/441964414116179968?callback=__twttr.callbacks.tl_i0_441964414116179968_old&dnt=true&domain=www.darkreading.com&lang=en&suppress_response_codes=true&t=1695492&tz=GMT%2B0000

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

HTTP/1.1

Server

68.232.35.172 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

tsa_o /

Resource Hash

f2f3579ba983156cf58a4d9d8ca261ed6ac3426c6f454f2121908c3da804e661

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
Content-Encoding: gzip
x-content-type-options: nosniff
content-disposition: attachment; filename=jsonp.jsonp
Content-Length: 10243
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 358
last-modified: Thu, 10 May 2018 09:08:04 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
Content-Type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=300
x-connection-hash: 4ee333bde78fb2288c8a9b5edb36fd52
timing-allow-origin: *
x-transaction: 009fd2ce001f0464
expires: Thu, 10 May 2018 09:13:04 GMT

GET
S 200 syndication
syndication.twitter.com/i/jot/ 43 B
166 B 112ms
111ms Image
image/gif 104.244.42.136
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?dnt=1&l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1525943283786%2C%22dnt%22%3Atrue%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

104.244.42.136 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 105
pragma: no-cache
last-modified: Thu, 10 May 2018 09:08:03 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 33503bd10c49e4a14333ac8393bb92f3
x-transaction: 002133da0090c552
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 tweet_button.d383dc1d510865aceaa5e552afcf5663.en.html
platform.twitter.com/widgets/ Frame E459 0
0 6ms
6ms Document
text/html 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.d383dc1d510865aceaa5e552afcf5663.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/tweet_button.d383dc1d510865aceaa5e552afcf5663.en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

status: 200
date: Thu, 10 May 2018 09:08:03 GMT
last-modified: Mon, 07 May 2018 21:48:21 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "5d0a889c7bf3bef09df8fe565a24c998+gzip"
content-encoding: gzip
accept-ranges: bytes
via: 1.1 varnish
age: 212701
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
x-cache: HIT
x-timer: S1525943284.823012,VS0,VE0
vary: Accept-Encoding,Host
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 12512

GET
H/1.1

200
OK

svrGP.aspx Show response
s657486201.t.eloqua.com/visitor/v200/
Redirect Chain

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=823
https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=823&elqCookie=1

0
418 B

112ms
111ms

Script
application/javascript

142.0.160.13
Oracle Corporation

General

Check archive.org

Show headers Download Go to

Full URL

https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=823&elqCookie=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

142.0.160.13 Redwood City, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=3600; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Thu, 10 May 2018 09:08:03 GMT
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA"
Cache-Control: private,no-cache, no-store
Content-Type: application/javascript
Content-Length: 20
Expires: -1

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=3600; includeSubDomains
X-Content-Type-Options: nosniff
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA"
Location: //s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=823&elqCookie=1
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 278
Expires: -1

GET
H/1.1 200
OK svrGP
s657486201.t.eloqua.com/visitor/v200/ 49 B
387 B 413ms
103ms Image
image/gif 142.0.160.13
Oracle Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=657486201&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

142.0.160.13 Redwood City, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),

Reverse DNS

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=3600; includeSubDomains
X-Content-Type-Options: nosniff
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA"
Cache-Control: private,no-cache, no-store
Content-Type: image/gif
Content-Length: 49
Expires: -1

GET
H/1.1

200
OK

svrGP.aspx
s2150.t.eloqua.com/visitor/v200/
Redirect Chain

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled
https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled&elqCookie=1

49 B
387 B

182ms
181ms

Image
image/gif

209.167.231.17
Oracle Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled&elqCookie=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

HTTP/1.1

Server

209.167.231.17 , United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),

Reverse DNS

e017.en25.com

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=3600; includeSubDomains
X-Content-Type-Options: nosniff
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA"
Cache-Control: private,no-cache, no-store
Content-Type: image/gif
Content-Length: 49
Expires: -1

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=3600; includeSubDomains
X-Content-Type-Options: nosniff
Date: Thu, 10 May 2018 09:08:03 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA"
Location: //s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=https://t.co/XK6tlvz48H&tzo=0&ms=823&optin=disabled&elqCookie=1
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 294
Expires: -1

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
110 B 15ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss82nqqc4MaWp4V1C9PJNmB3PYMzTdnidgd8hF-sUyOCoPyWc1JdbnQ3PkdfYUF3rCSKfElgSxqViRdZW-3DECEUQg6gyilJ_s&sig=Cg0ArKJSzJgD16TnyRvHEAE&id=osdim&ti=1&r=z&adk=929715771&tt=1072&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=2697,313,2697,915&mraid_race=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,4673&ss=1600,1200&pt=-1&deb=1-0-9-12-13--1-22-4&tvt=1060&op=1&uc=1&tgt=DIV&cl=1&cec=6&clc=0&cac=0&cd=602x0&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Cookie set iframe
sync.teads.tv/ Frame A993 0
0 150ms
51ms Document
text/html 52.213.148.252
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.teads.tv/iframe?pid=21882&userId=c53d1d3f-5220-45d4-8e99-13f50385e1a5&1525943283940
Requested by: Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.148.252 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-213-148-252.eu-west-1.compute.amazonaws.com
Software: akka-http/10.1.0-RC2 /
Resource Hash

Request headers

Host: sync.teads.tv
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Accept-Encoding: gzip, deflate
Cookie: tt_viewer=97ac2f5e-9ab0-41e7-a883-f0fe7981ee36
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Response headers

Content-Type: text/html; charset=UTF-8
Date: Thu, 10 May 2018 09:08:04 GMT
Server: akka-http/10.1.0-RC2
Set-Cookie: tt_exelate=; Expires=Fri, 11 May 2018 09:08:04 GMT; Domain=.teads.tv tt_bluekai=; Expires=Fri, 11 May 2018 09:08:04 GMT; Domain=.teads.tv tt_emetriq=; Expires=Fri, 11 May 2018 09:08:04 GMT; Domain=.teads.tv
Content-Length: 1666
Connection: keep-alive

GET
H/1.1 200
OK ad Show response
a.teads.tv/page/11512/ 98 B
467 B 58ms
54ms XHR
application/json 54.77.236.13
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/11512/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=&page=%7B%22id%22%3A11512%2C%22placements%22%3A%5B%7B%22id%22%3A21882%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A489%2C%22height%22%3A275%7D%2C%22slotType%22%3A%22native%22%7D%5D%7D&userId=c53d1d3f-5220-45d4-8e99-13f50385e1a5&formatVersion=2.18.75&env=js-web
Requested by: Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Protocol: HTTP/1.1
Server: 54.77.236.13 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-77-236-13.eu-west-1.compute.amazonaws.com
Software: teads-ssp /
Resource Hash: 2465f67342841d5db9f96c3ec1d4428c00e6d62c10424d6f9262403d599e9e92

Request headers

Accept: application/json; charset=UTF-8
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Content-Encoding: gzip
Server: teads-ssp
Content-Type: application/json
Access-Control-Allow-Origin: https://www.darkreading.com
Cache-Control: no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 111
Expires: 0

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 9ms
6ms Image
image/gif 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1525943283935&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=03222643
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:03 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 139ms
28ms Image
image/gif 52.50.3.180
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=placementCall&pageId=11512&pid=21882&gid=&slot=native&env=js-web&ts=1525943283924
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 52.50.3.180 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-50-3-180.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 139ms
28ms Image
image/gif 52.50.3.180
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=slotAvailable&pageId=11512&pid=21882&gid=&slot=native&env=js-web&ts=1525943283934
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 52.50.3.180 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-50-3-180.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK adchoices.svg
cdn.teads.tv/media/format/v3/assets/default/svg/ 650 B
882 B 8ms
7ms Image
image/svg+xml 2.18.234.227
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.teads.tv/media/format/v3/assets/default/svg/adchoices.svg
Requested by: Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Protocol: HTTP/1.1
Server: 2.18.234.227 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b0ff19f873fed3382a390aa1e4ec0feffd4f0ddc0eb50f7e090624d8db0fa12f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 May 2018 09:08:57 GMT
Server: AmazonS3
x-amz-request-id: 0BA7BF163C796C55
ETag: "527eadb6f68d60e9d70bcaa0628cf6c9"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=211
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 423
x-amz-id-2: JTB9UfZHGNZUCuhfyEzB7BHn5Wp5+jDAoU2IRlvE4G0qlsk/sZu8HK2SJxQAV9zDd6HiRphfxVA=

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
110 B 17ms
16ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvsWGYvDB9k7kFVyXvrFYFU4TbomthX5G6WXNNCyFfnq1yFATHbaQYqptcDdW1xPSHRpYr5t8XGJeEdl8L5LjgRdPDbX3PYnOk&sig=Cg0ArKJSzH4w4gpAMouTEAE&id=osdim&ti=1&r=z&adk=3939335409&tt=1380&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=2703,313,2703,915&mraid_race=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,5141&ss=1600,1200&pt=-1&deb=1-0-9-20-14--1-32-5&tvt=1368&op=1&uc=1&tgt=DIV&cl=1&cec=6&clc=0&cac=0&cd=602x0&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
110 B 15ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu2mkI3_98kO5lyXj8Ah_XZVGT8ybufOg44fo1j3aPi4ORMJcMGt2Vu78SpN25mne0d7G7UA-u37P-CVYVm-YKzR6afP3m6cPU&sig=Cg0ArKJSzKpewXWGfN9pEAE&id=osdim&ti=1&r=z&adk=2285942263&tt=1380&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=412,935,412,1271&mraid_race=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,5141&ss=1600,1200&pt=-1&deb=1-0-9-20-14--1-32-5&tvt=1368&op=1&uc=1&tgt=DIV&cl=1&cec=5&clc=0&cac=0&cd=336x0&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s29-in-f10.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 415ms
103ms Image
image/gif 54.236.81.21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiOjAsImNsaWVudFRpbWVzdGFtcCI6MTUyNTk0MzI4NC4xNDcsIm5hbWUiOiJjb250YWluZXJCZWNhbWVWaWV3YWJsZSJ9XX0=?crc32c=2680239325
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 54.236.81.21 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-236-81-21.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:04 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
S 200 OC9qrSG0
pbs.twimg.com/ad_img/994315221257814016/ Frame 7CDB 55 KB
56 KB 7ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/ad_img/994315221257814016/OC9qrSG0?format=jpg&name=orig

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41C3) /

Resource Hash

c09436fde40282eeb0f7518ab7365afb47867a87beab540460f64f1404010c84

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 121
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: ad_img ad_img/bucket/8 ad_img/994315221257814016
last-modified: Wed, 09 May 2018 20:34:36 GMT
server: ECS (fcn/41C3)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 176727e4086705fa5ff8716095cbbdb0
accept-ranges: bytes
content-length: 56557

GET
S 200 css
fonts.googleapis.com/ Frame C02E 254 B
320 B 14ms
14ms Stylesheet
text/css 172.217.18.170
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400&text=RESOUCBLG

Requested by

Host: t.co
URL: https://t.co/XK6tlvz48H

Protocol

SPDY

Server

172.217.18.170 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

7bf28da809712b3fb6b864b42d38018e8ff4296aef56a6e9b5321312f80538b1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 09:08:04 GMT

GET
S 200 timeline.e783991e0672c909d3fc09a8416757c3.light.ltr.css
platform.twitter.com/css/ Frame 7CDB 59 KB
13 KB 6ms
6ms Stylesheet
text/css 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.e783991e0672c909d3fc09a8416757c3.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: 9e87ce756ae559a43eb7f7c8e3bedaf1d31bb9fcbd36d87e48bc2551bb8d6d12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
age: 212702
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 13308
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
last-modified: Mon, 07 May 2018 21:48:18 GMT
x-timer: S1525943284.249114,VS0,VE0
etag: "66dbb50c6c7535374984e5fccef39d71+gzip"
vary: Accept-Encoding,Host
content-type: text/css; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes

GET
S 200 timeline.e783991e0672c909d3fc09a8416757c3.light.ltr.css
platform.twitter.com/css/ 59 KB
59 KB 7ms
6ms Image
text/css 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.e783991e0672c909d3fc09a8416757c3.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
age: 212702
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 13308
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
last-modified: Mon, 07 May 2018 21:48:18 GMT
x-timer: S1525943284.249134,VS0,VE0
etag: "66dbb50c6c7535374984e5fccef39d71+gzip"
vary: Accept-Encoding,Host
content-type: text/css; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes

GET
H/1.1 200
OK 5772dda68e8027153edc8f4f
polo-v1.feathr.co/v1/analytics/version/ 18 B
397 B 112ms
112ms Other
application/json 23.21.80.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://polo-v1.feathr.co/v1/analytics/version/5772dda68e8027153edc8f4f
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 23.21.80.160 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-23-21-80-160.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: 53d0bd0d7dcc4f7d177829026f9f473fd8a5b5cd328c483a883de9a70ba33f1f

Request headers

Accept: application/json
Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 10 May 2018 09:08:04 GMT
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 18

GET
S 200 Left_Of_Breach.jpg
cache-ssl.celtra.com/api/blobs/a5ff4deb516e26d838de499235f2aa0e35d7ed1726f8311a711eaba3f4049566/ Frame C02E 7 KB
7 KB 38ms
36ms Image
image/jpeg 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/a5ff4deb516e26d838de499235f2aa0e35d7ed1726f8311a711eaba3f4049566/Left_Of_Breach.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: f2e29a56942dadb86e7f5efb6355eef7c24c481cfe719cfb480f633c44657aa8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 08 May 2018 15:41:29 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 149195
x-cache: Hit from cloudfront
status: 200
content-length: 6979
server: Apache
etag: "f2e29a56942dadb86e7f5efb6355eef7c24c481cfe719cfb480f633c44657aa8"
x-varnish: 66765890 83145849
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: uDyGje_DVqiOgb_WdCWnVYEcQH0n4P8WfKGrXlSJRxFsDgtO4qGHSg==

GET
S 200 Cofense_Malware_Review.jpg
cache-ssl.celtra.com/api/blobs/1fd5fa209a0e91fff3972368ea7dafe8e5524f87c79ca9af5b090eecfbdea91a/ Frame C02E 7 KB
8 KB 37ms
36ms Image
image/jpeg 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/1fd5fa209a0e91fff3972368ea7dafe8e5524f87c79ca9af5b090eecfbdea91a/Cofense_Malware_Review.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 9fb46feb076725591bd7119bceea5e7317a20aead42af8511ff4b704fa78a919

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 08 May 2018 15:41:29 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 149195
x-cache: Hit from cloudfront
status: 200
content-length: 7243
server: Apache
etag: "9fb46feb076725591bd7119bceea5e7317a20aead42af8511ff4b704fa78a919"
x-varnish: 75340184 93718460
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: M_suboBbkV9m5kxCKyxgkPJ0GmUKovHKFpkWtvVsN9Kx6peAfIl16g==

GET
S 200 imgad
tpc.googlesyndication.com/pagead/ 119 KB
119 KB 8ms
8ms Image
image/png 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKCbxO3uCBABGAEyCM1dEWyqXOxm

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

2d2b1680997358c37f5d191e63c4f1b2317eb74113c70126b91f59ee88230ed1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Wed, 09 May 2018 02:35:54 GMT
x-content-type-options: nosniff
server: cafe
age: 109930
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
status: 200
cache-control: public, max-age=604800
content-disposition: attachment; filename="image.png"
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 121682
x-xss-protection: 1; mode=block
expires: Wed, 16 May 2018 02:35:54 GMT

GET
S 200 Five_Phishing_Predictions.jpg
cache-ssl.celtra.com/api/blobs/ef75c34df207ec2d14a35f9d5f2c1bff3bdc9e164f77942eff5bc7a132d2aceb/ Frame C02E 10 KB
10 KB 36ms
36ms Image
image/jpeg 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/ef75c34df207ec2d14a35f9d5f2c1bff3bdc9e164f77942eff5bc7a132d2aceb/Five_Phishing_Predictions.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: ea16aafabae02503311279dfdd2f62213a5d65b7abce400260ea31e03b69e692

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 08 May 2018 15:41:24 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 149200
x-cache: Hit from cloudfront
status: 200
content-length: 9971
server: Apache
etag: "ea16aafabae02503311279dfdd2f62213a5d65b7abce400260ea31e03b69e692"
x-varnish: 92636185 79844289
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: LZs1CLZZp66csP56ZriU28hMtndFa9iA3hIoU17mWOq6gCMSkHOKMA==

GET
S 200 Phishing_Response_Trends.jpg
cache-ssl.celtra.com/api/blobs/f05a589916f2022a7cd2d10ba7d5972e2445f5af29224eecbbd18410a00d0d11/ Frame C02E 8 KB
9 KB 37ms
37ms Image
image/jpeg 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/f05a589916f2022a7cd2d10ba7d5972e2445f5af29224eecbbd18410a00d0d11/Phishing_Response_Trends.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: c161487d86b8a70e6264f5ae1296eeee0cc1d2cdad90ee948678afe8eaa7a5ea

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 08 May 2018 15:43:28 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 149076
x-cache: Hit from cloudfront
status: 200
content-length: 8631
server: Apache
etag: "c161487d86b8a70e6264f5ae1296eeee0cc1d2cdad90ee948678afe8eaa7a5ea"
x-varnish: 86516264 80134649
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: RSUyZU47mrOw7N4ejLy1CXMrU85Hbyp7NwHRU56z8mOvXim50vZRJA==

GET
S 200 font
fonts.gstatic.com/l/ Frame C02E 6 KB
4 KB 21ms
21ms Font
font/ttf 172.217.23.131
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/l/font?kit=S6uyw4BMUTPHvxkiUk3sWWCkoo9muw&skey=2d58b92a99e1c086&v=v14

Requested by

Host: t.co
URL: https://t.co/XK6tlvz48H

Protocol

SPDY

Server

172.217.23.131 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s18-in-f3.1e100.net

Software

ESF /

Resource Hash

309d66670a8e33987ae002c028d8653ce3f9446b861fdeace8b2ff1cc23db9a0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:400&text=RESOUCBLG
Origin: https://www.darkreading.com

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
last-modified: Wed, 11 Oct 2017 18:44:21 GMT
server: ESF
status: 200
x-frame-options: SAMEORIGIN
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
content-disposition: attachment; filename="font.ttf"; filename*=UTF-8''font.ttf
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection: 1; mode=block
expires: Fri, 11 May 2018 09:08:04 GMT

GET
S 200 PhishMe-Asset5.png
cache-ssl.celtra.com/api/blobs/f37486e72302ac673cf2bb49fe15d020a88538432a827f3036eacdd86dcf6558/ Frame C02E 44 KB
44 KB 38ms
38ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/f37486e72302ac673cf2bb49fe15d020a88538432a827f3036eacdd86dcf6558/PhishMe-Asset5.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: f0430e5925dcbdc58a221a642511d0075d861713325010268d9ad98dd7a41964

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 01:44:36 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 15751408
x-cache: Hit from cloudfront
status: 200
content-length: 44545
server: Apache
etag: "f0430e5925dcbdc58a221a642511d0075d861713325010268d9ad98dd7a41964"
x-varnish: 1596230715
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 4Klvd0pNUqYlux-DtfjC28aTHoiGBqYpZ9yEy__YShD6Fc28dDFFGg==

GET
S 200 yt_hover.png
cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/ Frame C02E 918 B
1 KB 38ms
37ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/yt_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Fri, 08 Dec 2017 20:26:37 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 13178487
x-cache: Hit from cloudfront
status: 200
content-length: 918
server: Apache
etag: "6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677"
x-varnish: 77243550
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: d-OGoV4jDwI0Ubt3g00ofJuC8D-zQvTE7f_yKQvSHuO3Qqg35nYiLg==

GET
S 200 yt.png
cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/ Frame C02E 914 B
1 KB 38ms
37ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/yt.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sun, 02 Apr 2017 07:35:49 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 15748081
x-cache: Hit from cloudfront
status: 200
content-length: 914
server: Apache
etag: "8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28"
x-varnish: 886560897
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: VuFfrmdXG97_61YsyeC3hJdcHiZoLzF0513zOvuHRHgNczw_rDoGRw==

GET
S 200 li_hover.png
cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/ Frame C02E 591 B
1 KB 38ms
37ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/li_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sun, 28 May 2017 19:37:23 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 29943041
x-cache: Hit from cloudfront
status: 200
content-length: 591
server: Apache
etag: "c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794"
x-varnish: 448568839
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: nm49LUFs0evwhy1GlGwxM9joLSnzGGuUzujj8fAMFN0pqH-DdDweyA==

GET
S 200 li.png
cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/ Frame C02E 585 B
1 KB 38ms
37ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/li.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Mon, 18 Dec 2017 08:12:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 12358537
x-cache: Hit from cloudfront
status: 200
content-length: 585
server: Apache
etag: "d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c"
x-varnish: 768925
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: xLtrLPrN39p_8UWNWm08kh_Ovprau8P16xjEztVp2itFiQLFMmlJ4Q==

GET
S 200 fb_hover.png
cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/ Frame C02E 348 B
815 B 38ms
37ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/fb_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sun, 02 Apr 2017 05:53:22 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 15718137
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39"
x-varnish: 660192494
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: bHKR4T7RkIyvFpTwkMV7D2vlM20aD_xpONT4RouRp66RnVQdOA1jlQ==

GET
S 200 fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame C02E 348 B
815 B 59ms
58ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sun, 28 May 2017 06:51:04 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 29989020
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish: 448504826
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: AIE7KR9fcDRDVsLmXTiPrJHHuV3Qn_oYpsHbpZm89MwCwPHoPnzvgw==

GET
S 200 tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame C02E 781 B
1 KB 59ms
59ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sat, 01 Apr 2017 08:51:06 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 12358537
x-cache: Hit from cloudfront
status: 200
content-length: 781
server: Apache
etag: "308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish: 660129894
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: _gJiOJoWUk2TogidVXkc0evZ0ZPTyd6SOP7xSAICncKpu8hPlROBIQ==

GET
S 200 tw_hover.png
cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/ Frame C02E 777 B
1 KB 59ms
59ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/tw_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sat, 01 Apr 2017 08:51:07 GMT
via: 1.1 varnish, 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 19539429
x-cache: Hit from cloudfront
status: 200
content-length: 777
server: Apache
etag: "1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e"
x-varnish: 886494228
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: _EQv09QHZij_PMCPM9zEKSQALcAygmA1lyzk8NLDL7dbl_gsNnAzkA==

GET
S 200 rss.png
cache-ssl.celtra.com/api/blobs/b1cdc0ecb51975dba9ab6759d0985f34bf971d517bb87e169f46d806ce108101/ Frame C02E 988 B
1 KB 59ms
59ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/b1cdc0ecb51975dba9ab6759d0985f34bf971d517bb87e169f46d806ce108101/rss.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 4e668c3c5ead2707062c31387d0b2fc6883cbff5895585e08d923f3759a33140

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Fri, 08 Dec 2017 10:16:54 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 13215070
x-cache: Hit from cloudfront
status: 200
content-length: 988
server: Apache
etag: "4e668c3c5ead2707062c31387d0b2fc6883cbff5895585e08d923f3759a33140"
x-varnish: 46114625
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: qc9FKff1jaae72Tq2JaELUPw9mfKIT1i2SeKkOExzWt8mE8umXvihg==

GET
S 200 rss_hover.png
cache-ssl.celtra.com/api/blobs/82a3278077b1fa57b623faca8218253948280aafcfffcf15d53c579aeff15a03/ Frame C02E 990 B
1 KB 60ms
60ms Image
image/png 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/82a3278077b1fa57b623faca8218253948280aafcfffcf15d53c579aeff15a03/rss_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 2b8322bfccaa5c0aa4a37e06b916b11d517b7a2974ce3cd810ea57ba3a1ffd68

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Mon, 18 Dec 2017 09:06:42 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 12355282
x-cache: Hit from cloudfront
status: 200
content-length: 990
server: Apache
etag: "2b8322bfccaa5c0aa4a37e06b916b11d517b7a2974ce3cd810ea57ba3a1ffd68"
x-varnish: 2571162
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: mbM3G4qu8daKIdo0FgvcunZ1mhakkNc548t9o2r5yuf9YpCl9W8_Ng==

GET
S 200 CofenseLogo.jpg
cache-ssl.celtra.com/api/blobs/8db61dd4d959e8560b4d34f23ec5fbe46c9261ef0a2b7432c2f64e41569b2f0f/ Frame C02E 4 KB
5 KB 57ms
56ms Image
image/jpeg 13.32.121.162
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/8db61dd4d959e8560b4d34f23ec5fbe46c9261ef0a2b7432c2f64e41569b2f0f/CofenseLogo.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: SPDY
Server: 13.32.121.162 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-32-121-162.prg50.r.cloudfront.net
Software: Apache /
Resource Hash: 69a8898361de3dce6489d6d698d64d9351af0fa0f680300fd97af3b6db377ec6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 03 May 2018 21:11:11 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 26da51f10a91928e1070b585bfcd6b02.cloudfront.net (CloudFront)
age: 561413
x-cache: Hit from cloudfront
status: 200
content-length: 4458
server: Apache
etag: "69a8898361de3dce6489d6d698d64d9351af0fa0f680300fd97af3b6db377ec6"
x-varnish: 70386675
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: h02tOxVh9rT_I47ZKGsgmYlgEckLPrNE4GHh0pzpduTIUzd98MjlKw==

GET
S 200 51884c2678de42c07d56ea2d5ff835e6_normal.png
pbs.twimg.com/profile_images/3568861718/ Frame 7CDB 1 KB
1 KB 7ms
6ms Image
image/png 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/3568861718/51884c2678de42c07d56ea2d5ff835e6_normal.png

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41E0) /

Resource Hash

70e107bcfbe669f767db1c19527f006c232f63df7ad6037ff4df116b383dba5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: e47kaJIWWGOQoAcAstSlkQ==
x-cache: HIT
status: 200
content-length: 1123
x-response-time: 119
surrogate-key: profile_images profile_images/bucket/7 profile_images/3568861718
last-modified: Thu, 04 Nov 2010 01:42:54 GMT
server: ECS (fcn/41E0)
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 53559efdad80fe249a74329e7aa65d58
accept-ranges: bytes

GET
S 200 PqbDW_58_normal.jpg
pbs.twimg.com/profile_images/829695761646510080/ Frame 7CDB 2 KB
2 KB 29ms
28ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/829695761646510080/PqbDW_58_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4196) /

Resource Hash

ccbdfab4e801cb50f8f7996555402b6f0f1b69b8e3016c92cbff8c9c104231d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: LoPmASalvbjAv/P2MGjB6g==
x-cache: HIT
status: 200
content-length: 1959
x-response-time: 131
surrogate-key: profile_images profile_images/bucket/5 profile_images/829695761646510080
last-modified: Thu, 09 Feb 2017 14:15:39 GMT
server: ECS (fcn/4196)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c6e87daa4b017e850ef90f54b818cae2
accept-ranges: bytes

GET
S 200 rlLa0cM-_normal.jpg
pbs.twimg.com/profile_images/797747878684925953/ Frame 7CDB 2 KB
3 KB 7ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/797747878684925953/rlLa0cM-_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41E2) /

Resource Hash

b91a8828d1c6f30248b6d601888d9db3dfad830105645d079935eb326b252d89

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: rZViyvZPQcJXKerxqTqyHg==
x-cache: HIT
status: 200
content-length: 2415
x-response-time: 123
surrogate-key: profile_images profile_images/bucket/9 profile_images/797747878684925953
last-modified: Sun, 13 Nov 2016 10:26:10 GMT
server: ECS (fcn/41E2)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: dc4e8102b69ca449af21252589fdc14a
accept-ranges: bytes

GET
S 200 kbz3JWDM_normal.jpg
pbs.twimg.com/profile_images/816255923987611648/ Frame 7CDB 2 KB
2 KB 7ms
7ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/816255923987611648/kbz3JWDM_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/419B) /

Resource Hash

2a6489e8b48549ce893b31b727436935ecd507d20709d98a7716ba1a3e9a22c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: 4eFzhDbcVjj2AzhuOVqH+Q==
x-cache: HIT
status: 200
content-length: 1883
x-response-time: 128
surrogate-key: profile_images profile_images/bucket/1 profile_images/816255923987611648
last-modified: Tue, 03 Jan 2017 12:10:32 GMT
server: ECS (fcn/419B)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 75d14ac447cb56637659c1e8e2fb05f6
accept-ranges: bytes

GET
S 200 otCZyWOL_normal.jpg
pbs.twimg.com/profile_images/629572163058577408/ Frame 7CDB 2 KB
2 KB 7ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/629572163058577408/otCZyWOL_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41D7) /

Resource Hash

fbbee6029836a889af64b96e05651d78a6efd94124886c81ed37457cdcfd7db2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 125
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: profile_images profile_images/bucket/3 profile_images/629572163058577408
last-modified: Fri, 07 Aug 2015 08:35:55 GMT
server: ECS (fcn/41D7)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 2b77cb58f5c196764e5a4d44a642656c
accept-ranges: bytes
content-length: 1807

GET
S 200 BIO_normal.jpg
pbs.twimg.com/profile_images/1622706895/ Frame 7CDB 7 KB
7 KB 11ms
10ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1622706895/BIO_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41B7) /

Resource Hash

de8e8291395d39dcb141f7358e470d9caf369a62817ca0af6ab5b1d711983673

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: 909wrj3QPAvcFEVo1pzc/Q==
x-cache: HIT
status: 200
content-length: 7190
x-response-time: 125
surrogate-key: profile_images profile_images/bucket/0 profile_images/1622706895
last-modified: Thu, 04 Nov 2010 01:42:54 GMT
server: ECS (fcn/41B7)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 59f41fac2c46c73c0cbdf451c596cb62
accept-ranges: bytes

GET
S 200 U1x4jo79_normal.jpg
pbs.twimg.com/profile_images/710277174180184065/ Frame 7CDB 2 KB
2 KB 8ms
7ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/710277174180184065/U1x4jo79_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4191) /

Resource Hash

6881dba9204410b5151e4521f93d928524738297f8bf0fdc0a6af1ccab40ef72

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: aHI+65tQNzdlgY/d+V29Hg==
x-cache: HIT
status: 200
content-length: 1959
x-response-time: 120
surrogate-key: profile_images profile_images/bucket/7 profile_images/710277174180184065
last-modified: Thu, 17 Mar 2016 01:28:49 GMT
server: ECS (fcn/4191)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 48bd46d099b31325f3a468f3783e43d2
accept-ranges: bytes

GET
S 200 Y75rtqI4_normal.jpg
pbs.twimg.com/profile_images/975746583013789697/ Frame 7CDB 2 KB
2 KB 6ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/975746583013789697/Y75rtqI4_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41CB) /

Resource Hash

eb4ae1d5ff52c3d195152e767c90a5ea370dbf3a61fbb4372e5d5f841c4340e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 113
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: profile_images profile_images/bucket/0 profile_images/975746583013789697
last-modified: Mon, 19 Mar 2018 14:49:28 GMT
server: ECS (fcn/41CB)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c96b0bda00249995e87a77f07f05c93f
accept-ranges: bytes
content-length: 2187

GET
S 200 IMGP0223-rotated_normal.jpg
pbs.twimg.com/profile_images/2406560049/ Frame 7CDB 7 KB
7 KB 7ms
7ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/2406560049/IMGP0223-rotated_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A4) /

Resource Hash

e1856b713f50debf28caacb15278a28192d936f201f04123f544dd6fc34ce3be

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: 33jeN5ywDPta6EJsFkjAGA==
x-cache: HIT
status: 200
content-length: 7190
x-response-time: 197
surrogate-key: profile_images profile_images/bucket/2 profile_images/2406560049
last-modified: Thu, 04 Nov 2010 01:42:54 GMT
server: ECS (fcn/41A4)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: ea222c3d58177713445c4663f76cf330
accept-ranges: bytes

GET
S 200 rD9oD8tS_normal.png
pbs.twimg.com/profile_images/459319094039175168/ Frame 7CDB 3 KB
3 KB 8ms
7ms Image
image/png 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/459319094039175168/rD9oD8tS_normal.png

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41C3) /

Resource Hash

377e1a4319b485d9499641ff7e2317e0e80f6587e91206d6d2df2c7e45669f87

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: gV4k9fvZGhYDdzdf3Zd0LQ==
x-cache: HIT
status: 200
content-length: 3099
x-response-time: 123
surrogate-key: profile_images profile_images/bucket/0 profile_images/459319094039175168
last-modified: Thu, 24 Apr 2014 13:11:00 GMT
server: ECS (fcn/41C3)
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 85017b2cb351a3aa998c456a3b981a30
accept-ranges: bytes

GET
S 200 A4mG0U5P_normal.jpg
pbs.twimg.com/profile_images/885169621795565573/ Frame 7CDB 2 KB
2 KB 7ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/885169621795565573/A4mG0U5P_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/419C) /

Resource Hash

25b438de3e944547e69c6de98e403f46a9aa4fb98e6d1bb34954fd30ebc19b56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: XYJm9RrynObuKMwoj2vFqw==
x-cache: HIT
status: 200
content-length: 1883
x-response-time: 327
surrogate-key: profile_images profile_images/bucket/8 profile_images/885169621795565573
last-modified: Wed, 12 Jul 2017 16:08:58 GMT
server: ECS (fcn/419C)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 439e684acf17ebb3756bb984b4a76032
accept-ranges: bytes

GET
S 200 k7PvYZYh_normal.png
pbs.twimg.com/profile_images/516372983808393216/ Frame 7CDB 2 KB
2 KB 6ms
6ms Image
image/png 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/516372983808393216/k7PvYZYh_normal.png

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4189) /

Resource Hash

65f1ae6a3f6a0276aa831d9da6eadb6529c3e78ca623902fd5e56b9548ed410c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: eXtgUa47vWaUSwN6Sl3aeA==
x-cache: HIT
status: 200
content-length: 2035
x-response-time: 127
surrogate-key: profile_images profile_images/bucket/0 profile_images/516372983808393216
last-modified: Sun, 28 Sep 2014 23:42:47 GMT
server: ECS (fcn/4189)
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: a03a4fcf730ace38c5f246584d8a4461
accept-ranges: bytes

GET
S 200 BsRYh8km_normal.jpg
pbs.twimg.com/profile_images/837055746965663763/ Frame 7CDB 2 KB
2 KB 6ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/837055746965663763/BsRYh8km_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41E4) /

Resource Hash

80cc0213b037302b15ad1bc3a8c0a2e500eaed2c0f45ca5d65d5b95ee54e060d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
content-md5: HjMWLz/5+W/EYRgRXtlYkQ==
x-cache: HIT
status: 200
content-length: 1959
x-response-time: 124
surrogate-key: profile_images profile_images/bucket/8 profile_images/837055746965663763
last-modified: Wed, 01 Mar 2017 21:41:36 GMT
server: ECS (fcn/41E4)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 36a093b215c752a283e5fd555eec8a83
accept-ranges: bytes

GET
S 200 Dc0sEa_W4AAcr9s
pbs.twimg.com/media/ Frame 7CDB 12 KB
13 KB 6ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/Dc0sEa_W4AAcr9s?format=jpg&name=360x360

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/419C) /

Resource Hash

55a45a37b0df9e49952ccd6d5fc53ff740cc37d37f696183b3afd0d34bf3e736

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 156
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: media media/bucket/0 media/994499547194908672
last-modified: Thu, 10 May 2018 08:47:03 GMT
server: ECS (fcn/419C)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: acb0e6c7257e9ec9648ec24402b41429
accept-ranges: bytes
content-length: 12712

GET
S 200 Dc0VpG8V0AEvJCL
pbs.twimg.com/media/ Frame 7CDB 12 KB
12 KB 7ms
7ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/Dc0VpG8V0AEvJCL?format=jpg&name=360x360

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A5) /

Resource Hash

66c37bbf0e23caa3dd667dbf8dbe170de29daa39f6443ad82f6c5a73363b6d78

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 141
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: media media/bucket/0 media/994474888701267969
last-modified: Thu, 10 May 2018 07:09:04 GMT
server: ECS (fcn/41A5)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 71d114875fc50bc2893d197dd1f1e698
accept-ranges: bytes
content-length: 11816

GET
S 200 DcnJ_IpXcAEBDiY
pbs.twimg.com/media/ Frame 7CDB 16 KB
17 KB 6ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/DcnJ_IpXcAEBDiY?format=jpg&name=360x360

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41DF) /

Resource Hash

417b2a1c0f64cb84fa638f9639dd80bf33e2d199e96a06c7f02adb9ebe501237

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 329
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: media media/bucket/0 media/993547279301832705
last-modified: Mon, 07 May 2018 17:43:05 GMT
server: ECS (fcn/41DF)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 2d7b3e02d6d9dddf50d3fed029db6dd4
accept-ranges: bytes
content-length: 16791

GET
S 200 Dcw00jlV0AAVs0N
pbs.twimg.com/media/ Frame 7CDB 17 KB
17 KB 6ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/Dcw00jlV0AAVs0N?format=jpg&name=360x360

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4192) /

Resource Hash

20e547fc20534433e949a6dec914a8d66da75de3a18246be0810b198e3036acd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 141
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: media media/bucket/9 media/994227695251738624
last-modified: Wed, 09 May 2018 14:46:49 GMT
server: ECS (fcn/4192)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 099a83d57fa6be0955d26608bb4dd628
accept-ranges: bytes
content-length: 17152

GET
S 200 DczLfgEWsAALqug
pbs.twimg.com/media/ Frame 7CDB 9 KB
10 KB 6ms
6ms Image
image/jpeg 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/DczLfgEWsAALqug?format=jpg&name=360x360

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41E8) /

Resource Hash

63b11f9d74abab9fd73b95b0723455def6319a3ed94412e88ed32713b4e5c91f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-response-time: 157
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
surrogate-key: media media/bucket/2 media/994393359786618880
last-modified: Thu, 10 May 2018 01:45:06 GMT
server: ECS (fcn/41E8)
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 7b1333aea4b1249ba499359517d0ed74
accept-ranges: bytes
content-length: 9563

GET
S 200 syndication_bundle_v1_e919bbf138685fdb8f6dc1141354c2234d5840c4.css
ton.twimg.com/tfw/css/ Frame 7CDB 43 KB
7 KB 8ms
7ms Stylesheet
text/css 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_e919bbf138685fdb8f6dc1141354c2234d5840c4.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A6) /

Resource Hash

d796792b176e942822ce3e97f11c7dd7c2a18fa92929b723a094795a9427f634

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 43755
x-cache: HIT
status: 200
content-length: 6658
x-response-time: 107
surrogate-key: tfw
last-modified: Wed, 09 May 2018 16:13:43 GMT
server: ECS (fcn/41A6)
etag: "wr3pmwTGVcRZxRFNYZyLcg=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://twitter.com
x-connection-hash: fe5c3af6d08d24cc1b3751b6b6ac3399
accept-ranges: bytes
expires: Thu, 17 May 2018 09:08:04 GMT

GET
S 200 syndication_bundle_v1_e919bbf138685fdb8f6dc1141354c2234d5840c4.css
ton.twimg.com/tfw/css/ 43 KB
43 KB 6ms
6ms Image
text/css 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_e919bbf138685fdb8f6dc1141354c2234d5840c4.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A6) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 43755
x-cache: HIT
status: 200
content-length: 6658
x-response-time: 107
surrogate-key: tfw
last-modified: Wed, 09 May 2018 16:13:43 GMT
server: ECS (fcn/41A6)
etag: "wr3pmwTGVcRZxRFNYZyLcg=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://twitter.com
x-connection-hash: fe5c3af6d08d24cc1b3751b6b6ac3399
accept-ranges: bytes
expires: Thu, 17 May 2018 09:08:04 GMT

GET
DATA 200
OK truncated
/ Frame 7CDB 618 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b051420a41347f3e04fbe6745d5fa58c3dfd40a7209b8dc09a138bc6381bd8dc

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CDB 559 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cd7887cf9a61431f64864df1e5fe9823e163638bf811dc97ee556268886bf865

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CDB 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CDB 739 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7CDB 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml;charset=utf-8

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
110 B 15ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsshD-0XsX6RQoRr_FF8S7O5Yz1Xcf24h1D3-eD5aXkAd7kJ2j57Rr_JjI09pS8X4xPldjLxwDktc51UxpF27kx0dGwCoWBXroE&sig=Cg0ArKJSzL8HCbpN-oMiEAE&id=osdim&ti=1&adk=2966194094&tt=1730&bs=1585,1200&mtos=1189,1189,1189,1189,1189&tos=1189,0,0,0,0&p=76,313,166,1272&mraid_race=1&mcvt=1189&rs=3&ht=0&tfs=541&tls=1729&mc=1&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,5141&ss=1600,1200&pt=-1&deb=1-0-9-21-15--1-43-6&tvt=1718&op=1&r=v&uc=3&tgt=DIV&cl=1&cec=7&clc=1&cac=0&cd=728x90&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
110 B 14ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvUIYqqLl-sfyfPlTse_uNIvEt5lf7WNXtiYgxhV8g5MCUTfJKcsiE0vFOfpeAj2M08OsKTESK2bnHrQJNYcT_qx5IjlLL8R1w&sig=Cg0ArKJSzJvg7KsmvMtIEAE&id=osdim&ti=1&r=z&adk=693593060&tt=1730&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=3916,935,3916,1271&mraid_race=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,5141&ss=1600,1200&pt=-1&deb=1-0-9-21-15--1-43-6&tvt=1718&op=1&uc=1&tgt=DIV&cl=1&cec=5&clc=0&cac=0&cd=336x0&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK IiwidG9wV2luZG93TG9jYXRpb25MZW5ndGgiOjExNSwibmFtZSI6ImVudmlyb25tZW50SW5mbyJ9LHsic2Vzc2lvbklkIjoiczE1MjU5NDMyODN4NGRjZDRkM2EyODI1YmF4MjY0ODkzODkiLCJhY2NvdW50SWQiOiI0NGI3NGIzNSIsInN0cmVhbSI6ImFkRXZlb...
track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDU... 35 B
242 B 119ms
102ms Image
image/gif 54.236.81.21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiOjEsImNsaWVudFRpbWVzdGFtcCI6MTUyNTk0MzI4NC4xNjEsInNjb3BlIjoiZ2xvYmFsIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBIZWFkbGVzc0Nocm9tZS82Ni4wLjMzNTkuMTM5IFNhZmFyaS81MzcuMzYiLCJvcmllbnRhdGlvbiI6MCwidG9wbW9zdFJlYWNoYWJsZVdpbmRvdyI6eyJ3aWR0aCI6MTYwMCwiaGVpZ2h0IjoxMjAwfSwiaG9zdFdpbmRvdyI6eyJ3aWR0aCI6MTYwMCwiaGVpZ2h0IjoxMjAwfSwibmVzdGluZyI6eyJpZnJhbWUiOmZhbHNlLCJmcmllbmRseUlmcmFtZSI6ZmFsc2UsImlhYkZyaWVuZGx5SWZyYW1lIjpmYWxzZSwiaG9zdGlsZUlmcmFtZSI6ZmFsc2UsImlmcmFtZURlcHRoIjowfSwicGFnZVZpc2liaWxpdHlBcGkiOnRydWUsInJlcXVlc3RBbmltYXRpb25GcmFtZSI6dHJ1ZSwidG9wV2luZG93TmF0aXZlUkFGU3VwcG9ydGVkIjp0cnVlLCJhbGxvd05vbk5hdGl2ZVJBRkZvclZpZXdhYmxlVGltZVVzZWQiOmZhbHNlLCJjbGllbnRUaW1lWm9uZU9mZnNldEluTWludXRlcyI6MCwic3VwcG9ydHNDb250YWluZXJWaWV3YWJpbGl0eSI6dHJ1ZSwic3VwcG9ydHNDb250YWluZXJJbml0aWFsVmlld2FiaWxpdHkiOnRydWUsInRhZ1BhcmVudFdpZHRoIjozMzYsInRhZ1BhcmVudEhlaWdodCI6MCwiYW1wRGV0ZWN0ZWQiOmZhbHNlLCJhbXBOZXN0aW5nTGV2ZWwiOiIiLCJzYWZlRnJhbWVEZXRlY3RlZCI6ZmFsc2UsImZldGNoU3VwcG9ydGVkIjp0cnVlLCJhc2FwRW5hYmxlZCI6bnVsbCwibmF0aXZlUHJvbWlzZXNTdXBwb3J0ZWQiOnRydWUsImJlYWNvblN1cHBvcnRlZCI6dHJ1ZSwiSW50ZXJzZWN0aW9uT2JzZXJ2ZXJTdXBwb3J0ZWQiOnRydWUsImlzTXV0YXRpb25PYnNlcnZlclN1cHBvcnRlZCI6dHJ1ZSwidG9wV2luZG93TG9jYXRpb24iOiJodHRwczovL3d3dy5kYXJrcmVhZGluZy5jb20vYXR0YWNrcy1icmVhY2hlcy9zeW5hY2stcmFuc29td2FyZS1nZXRzLWRhbmdlcm91cy1kb3BwbGVnYW5naW5nLWZlYXR1cmUvZC9kLWlkLzEzMzE3MzY/IiwidG9wV2luZG93TG9jYXRpb25MZW5ndGgiOjExNSwibmFtZSI6ImVudmlyb25tZW50SW5mbyJ9LHsic2Vzc2lvbklkIjoiczE1MjU5NDMyODN4NGRjZDRkM2EyODI1YmF4MjY0ODkzODkiLCJhY2NvdW50SWQiOiI0NGI3NGIzNSIsInN0cmVhbSI6ImFkRXZlbnRzIiwiaW5zdGFudGlhdGlvbiI6Ijk2NjQ0NTQwNTM2NDU2NjgiLCJpbmRleCI6MiwiY2xpZW50VGltZXN0YW1wIjoxNTI1OTQzMjg0LjQ5OCwibmFtZSI6ImNyZWF0aXZlTG9hZGVkIiwidmlld2FiaWxpdHkwME1lYXN1cmFibGUiOnRydWUsInZpZXdhYmlsaXR5NTAxTWVhc3VyYWJsZSI6dHJ1ZSwidmlld2FibGVUaW1lTWVhc3VyYWJsZSI6dHJ1ZSwiY2RuVmFyaWFudCI6Im5vbmUifSx7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiOjMsImNsaWVudFRpbWVzdGFtcCI6MTUyNTk0MzI4NC41MTUsIm5hbWUiOiJ2aWV3cG9ydFBsYWNlbWVudEdlb21ldHJ5IiwicGFnZURpbWVuc2lvbnMiOnsiaGVpZ2h0Ijo2MTQ1LCJ3aWR0aCI6MTU4NX0sInZpZXdwb3J0UG9zaXRpb25SZWN0Ijp7IndpZHRoIjoxNjAwLCJoZWlnaHQiOjEyMDAsImxlZnQiOjAsInRvcCI6MH0sImZpcnN0UGxhY2VtZW50UG9zaXRpb25SZWN0Ijp7ImxlZnQiOjkzNC41LCJ0b3AiOjQxMS45MjE4NzUsIndpZHRoIjozMzYsImhlaWdodCI6NjAwfX0seyJzZXNzaW9uSWQiOiJzMTUyNTk0MzI4M3g0ZGNkNGQzYTI4MjViYXgyNjQ4OTM4OSIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiOTY2NDQ1NDA1MzY0NTY2OCIsImluZGV4Ijo0LCJjbGllbnRUaW1lc3RhbXAiOjE1MjU5NDMyODQuNTI3LCJuYW1lIjoidmlld2FibGUwMCIsImNyaXRlcmlvbiI6eyJuYW1lIjoiQ29yZSIsInJhdGlvIjowLCJ0aW1lIjowfX0seyJzZXNzaW9uSWQiOiJzMTUyNTk0MzI4M3g0ZGNkNGQzYTI4MjViYXgyNjQ4OTM4OSIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiOTY2NDQ1NDA1MzY0NTY2OCIsImluZGV4Ijo1LCJjbGllbnRUaW1lc3RhbXAiOjE1MjU5NDMyODQuNTM5LCJ1bml0TmFtZSI6ImJhbm5lciIsInVuaXRWYXJpYW50TG9jYWxJZCI6bnVsbCwic2NyZWVuTG9jYWxJZCI6MTM2OCwic2NyZWVuVGl0bGUiOiJSZXNvdXJjZXMiLCJzY3JlZW5Jc01hc3RlciI6ZmFsc2UsIm9iamVjdExvY2FsSWQiOm51bGwsIm9iamVjdE5hbWUiOm51bGwsIm9iamVjdENsYXp6IjpudWxsLCJpbml0aWF0aW9uVGltZXN0YW1wIjoxNTI1OTQzMjg0LjUzOSwibmFtZSI6InNjcmVlblNob3duIn0seyJzZXNzaW9uSWQiOiJzMTUyNTk0MzI4M3g0ZGNkNGQzYTI4MjViYXgyNjQ4OTM4OSIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiOTY2NDQ1NDA1MzY0NTY2OCIsImluZGV4Ijo2LCJjbGllbnRUaW1lc3RhbXAiOjE1MjU5NDMyODQuNTM5LCJuYW1lIjoiY3JlYXRpdmVSZW5kZXJlZCJ9XX0=?crc32c=1516793293
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 54.236.81.21 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-236-81-21.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:04 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
S 200 news_stroke_v1_78ce5b21fb24a7c7e528d22fc25bd9f9df7f24e2.svg
ton.twimg.com/tfw/assets/ Frame 7CDB 829 B
544 B 10ms
9ms Image
image/svg+xml 93.184.220.70
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/assets/news_stroke_v1_78ce5b21fb24a7c7e528d22fc25bd9f9df7f24e2.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

93.184.220.70 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41AC) /

Resource Hash

5c0f79d0286f1fd3db48e1b689358017b302c0f4babde540329e8c644cf119c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ton.twimg.com/tfw/css/syndication_bundle_v1_e919bbf138685fdb8f6dc1141354c2234d5840c4.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 829
x-cache: HIT
status: 200
content-length: 395
x-response-time: 111
surrogate-key: tfw
last-modified: Fri, 04 May 2018 12:50:13 GMT
server: ECS (fcn/41AC)
etag: "CTUg6L9PuY+d9h5xpE0zmw=="
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://twitter.com
x-connection-hash: 45d238833153c74f071a66f449087689
accept-ranges: bytes
expires: Thu, 17 May 2018 09:08:04 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 194ms
101ms Image
image/gif 54.236.81.21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiOjcsImNsaWVudFRpbWVzdGFtcCI6MTUyNTk0MzI4NC41NTEsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNTI1OTQzMjg0LjUyOSwidG8iOjE1MjU5NDMyODQuNTI5fV19?crc32c=2203397419
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 54.236.81.21 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-236-81-21.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:04 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame AAA9 42 B
110 B 15ms
14ms Image
image/gif 216.58.207.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstKF2jci5Um3kwgA0uHm_P_6S1SRitCm-VU_66v-TlDECNmRspQyPBGjvajm6mJRQyku0ziwUb5SwxDbX4Otm1jBC9nWff714k&sig=Cg0ArKJSzPptugSzfJ8iEAE&id=osdim&ti=1&adk=4220632109&tt=1983&bs=1585,1200&mtos=1181,1181,1181,1181,1181&tos=1181,0,0,0,0&p=1032,953,1282,1253&mraid_race=1&mcvt=1181&rs=3&ht=0&tfs=802&tls=1982&mc=1&lte=1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,5156&ss=1600,1200&pt=-1&deb=1-0-9-22-16--1-54-7&tvt=1971&op=1&r=v&uc=7&tgt=DIV&cl=1&cec=5&clc=1&cac=0&cd=300x250&v=r20180507

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?

Protocol

SPDY

Server

216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

mpr1.ngd.vip.ir2.yahoo.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 28 KB
10 KB 7ms
6ms Script
text/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
Protocol: HTTP/1.1
Server: 2.18.233.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8a9b15b90191f5de8dba27203c66939122a504219c0570948786f26759463635

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id: MGipJPO47kwJ1ECqRNJAaU6sMLjnfe3y
Content-Encoding: gzip
ETag: "4edcd5ff60c42fe20447431436374569"
x-amz-request-id: 976BC52502BC8407
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 9136
x-amz-id-2: amAKNWW9aQIfrcXsTFW3jpPyy1HJxSu4x6E3hF44rEB+V89FfRIBY6ADoInCjugNjJB4dwgwt3U=
Last-Modified: Wed, 09 May 2018 22:10:18 GMT
Server: AmazonS3
Date: Thu, 10 May 2018 09:08:04 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK pixel.js Show response
polo-v1.feathr.co/v1/accounts/5772dda68e8027153edc8f4f/ 32 B
457 B 400ms
103ms Script
text/javascript 50.19.225.238
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://polo-v1.feathr.co/v1/accounts/5772dda68e8027153edc8f4f/pixel.js
Requested by: Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol: HTTP/1.1
Server: 50.19.225.238 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-50-19-225-238.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: eacfa4f711eaca1336ff82619c8a2d310dec11266d594fbc7e5a91259cebf848

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:05 GMT
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: must-revalidate, max-age=14400
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 32

GET
H/1.1 200
OK script.js Show response
polo-v1.feathr.co/v1/analytics/match/ 284 B
620 B 409ms
106ms Script
text/javascript 23.21.80.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://polo-v1.feathr.co/v1/analytics/match/script.js
Requested by: Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js
Protocol: HTTP/1.1
Server: 23.21.80.160 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-23-21-80-160.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: 93ea5d0f5fabecdbc72c5154f2856b2f50c7c2c6d5024d76d95480e7ee8f0bc8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:05 GMT
Content-Encoding: gzip
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: Accept-Encoding,User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: must-revalidate, max-age=120
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 156

GET
H/1.1 200
OK crumb
polo-v1.feathr.co/v1/analytics/ 43 B
459 B 543ms
229ms Image
image/gif 50.19.225.238
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polo-v1.feathr.co/v1/analytics/crumb?cb=1525943284439&a_id=5772dda68e8027153edc8f4f&ses_id=5af40bf339d65290e8986c6e&rfr=https%3A%2F%2Ft.co%2FXK6tlvz48H&flvr=page_view&loc_url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fsynack-ransomware-gets-dangerous-doppleganging-feature%2Fd%2Fd-id%2F1331736%3F&s_w=1600&s_h=1200&b_w=1600&b_h=1200&cust_params=e30=
Protocol: HTTP/1.1
Server: 50.19.225.238 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-50-19-225-238.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:05 GMT
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0,no-cache,no-store
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 43

GET
H/1.1 200
OK TQSV74R4GVCSJITSZC2MCP Show response
d.adroll.com/consent/check/ 27 B
187 B 29ms
29ms Script
application/javascript 54.246.124.93
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP?_s=a427ff3914440c7d7f4b22e79bea696f
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Server: 54.246.124.93 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-246-124-93.eu-west-1.compute.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: 01d1b1378f2c2e8d7c108db3114916ee5a3c20f33a07ea167f7495869e084801

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:04 GMT
Server: nginx/1.12.1
Connection: keep-alive
Content-Length: 27
Content-Type: application/javascript

GET
H/1.1

200
OK

DARDKNAFP5HS5ABHGM36J3.js Show response
s.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/
Redirect Chain

https://d.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG?pv=9861017202.474165&cookie=&adroll_s_ref=https%3A//t.co/XK6tlvz48H&keyw=&name=darkreading_attacks_breaches&arrfrr=https%3A%...
https://s.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/DARDKNAFP5HS5ABHGM36J3.js

3 KB
2 KB

183ms
182ms

Script
text/javascript

2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/DARDKNAFP5HS5ABHGM36J3.js
Protocol: HTTP/1.1
Server: 2.18.233.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8d6c777242831815b60f71d752bf8e4c87e36b9066535e80f3c76a68fd161f8f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id: juHtoZq_krsnPjGwJx2mxcEFdi5mZhQQ
Content-Encoding: gzip
ETag: "04948946d0335ff7c4d78486bb887712"
x-amz-request-id: 8D472D9264E8345F
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 997
x-amz-id-2: BHuKEnjgZrXr3o7KPrcJZihsgpJqNGZ45XBrN3dFSLnuK44oUXzMun149dIynaTTDaXi1k1M/Z0=
Last-Modified: Wed, 09 May 2018 23:30:27 GMT
Server: AmazonS3
Date: Thu, 10 May 2018 09:08:05 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Thu, 10 May 2018 09:08:04 GMT
X-Segment-Display-Name
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Connection: keep-alive
Content-Length: 0
Pragma: no-cache
X-Conversion-Value: 0.0
Server: nginx/1.12.1
X-Rule: +darkreading_attacks_breaches
X-Segment-Eid: DARDKNAFP5HS5ABHGM36J3
Location: https://s.adroll.com/pixel/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/DARDKNAFP5HS5ABHGM36J3.js
Cache-Control: no-store, no-cache, must-revalidate
X-Pixel-Eid: ACPJ7LN56VBITNNAUDPDMG
X-Segment-Name: darkreading_attacks_breaches
X-Advertisable-Eid: TQSV74R4GVCSJITSZC2MCP
X-Conversion-Currency

GET
S

204

sync
pixel.advertising.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/aol/out
https://pixel.advertising.com/ups/55980/sync?uid=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&_origin=1
https://pixel.advertising.com/ups/55980/sync?uid=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&_origin=1&verify=true

0
298 B

8ms
8ms

Image
text/plain

35.158.43.210
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.advertising.com/ups/55980/sync?uid=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&_origin=1&verify=true
Protocol: SPDY
Server: 35.158.43.210 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-158-43-210.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status: 204
date: Thu, 10 May 2018 09:08:05 GMT
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Thu, 10 May 2018 09:08:05 GMT
content-length: 0
location: https://pixel.advertising.com/ups/55980/sync?uid=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&_origin=1&verify=true
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expiration=1557479285
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expiration=1557479285&C=1

43 B
1 KB

12ms
12ms

Image
image/gif

2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expiration=1557479285&C=1
Protocol: HTTP/1.1
Server: 2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 10 May 2018 09:08:05 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expiration=1557479285&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Thu, 10 May 2018 09:08:05 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expires=365
https://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=194538&nid=3644&put=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expires=365

42 B
852 B

20ms
20ms

Image
image/gif

62.67.193.75
The Rubicon Project

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=194538&nid=3644&put=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expires=365
Protocol: HTTP/1.1
Server: 62.67.193.75 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: Rubicon Project /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:04 GMT
Server: Rubicon Project
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-RPHost: e8u6YRdcBiK-V4nsoROGPg
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:04 GMT
Server: Rubicon Project
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: /tap.php?cookie_redirect=1&v=194538&nid=3644&put=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA&expires=365
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

Pug
simage2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA

1 B
916 B

56ms
13ms

Image
text/html

198.47.127.15
PubMatic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA
Protocol: HTTP/1.1
Server: 198.47.127.15 Redwood City, United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:04 GMT
X-lat: Pug22025:0:425
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 1

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx/1.12.1
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 161

GET
S

204

/
trc.taboola.com/sg/adroll-network/1/rtb-h/
Redirect Chain

https://d.adroll.com/cm/taboola/out
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA

0
307 B

17ms
14ms

Image
text/plain

151.101.14.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA
Protocol: SPDY
Server: 151.101.14.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:05 GMT
via: 1.1 varnish
server: nginx
x-timer: S1525943285.107379,VS0,VE8
x-served-by: cache-fra19126-FRA
x-cache: MISS
status: 204
x-cache-hits: 0
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx/1.12.1
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Location: https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 111

GET
H/1.1

200
OK

pixel
ads.yahoo.com/
Redirect Chain

https://d.adroll.com/cm/r/out?advertisable=TQSV74R4GVCSJITSZC2MCP
https://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=https%3A%2F%2Fads.yahoo.com%2Fcms%2Fv1%3Fesig%3D1~bf4e7dc4546a90c08591652d78a230d3f2ef5733%26nwid%3D10001032567%26sigv%3D1

0
1 KB

102ms
31ms

Image
text/plain

217.12.15.83
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=https%3A%2F%2Fads.yahoo.com%2Fcms%2Fv1%3Fesig%3D1~bf4e7dc4546a90c08591652d78a230d3f2ef5733%26nwid%3D10001032567%26sigv%3D1

Protocol

HTTP/1.1

Server

217.12.15.83 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:05 GMT
Server: ATS
Age: 0
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Public-Key-Pins-Report-Only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
Connection: keep-alive
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx/1.12.1
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Location: https://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=https%3A%2F%2Fads.yahoo.com%2Fcms%2Fv1%3Fesig%3D1~bf4e7dc4546a90c08591652d78a230d3f2ef5733%26nwid%3D10001032567%26sigv%3D1
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 181

GET
H/1.1

200
OK

sync
t.visx.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?advertisable=TQSV74R4GVCSJITSZC2MCP
https://x.bidswitch.net/sync?dsp_id=44&user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA
https://t.visx.net/sync?tp_id=1&tp_uid=16f9eb8b-94aa-4430-9be9-c8ce4c335056&ssp_custom_data=
https://t.visx.net/ul_cb/sync?tp_id=1&tp_uid=16f9eb8b-94aa-4430-9be9-c8ce4c335056&ssp_custom_data=

43 B
627 B

17ms
17ms

Image
image/gif

35.187.123.169
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.visx.net/ul_cb/sync?tp_id=1&tp_uid=16f9eb8b-94aa-4430-9be9-c8ce4c335056&ssp_custom_data=
Protocol: HTTP/1.1
Server: 35.187.123.169 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 169.123.187.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://t.visx.net/ul_cb/sync?tp_id=1&tp_uid=16f9eb8b-94aa-4430-9be9-c8ce4c335056&ssp_custom_data=
Connection: keep-alive
Content-Length: 0
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

pxj
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?advertisable=TQSV74R4GVCSJITSZC2MCP
https://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid(%27ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA%27)

0
592 B

39ms
15ms

Image
text/html

185.33.223.200
AppNexus

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid(%27ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA%27)

Protocol

HTTP/1.1

Server

185.33.223.200 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:07 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.248:80
AN-X-Request-Uuid: a16998ca-1021-4040-9cfe-692c70260a48
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx/1.12.1
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Location: https://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZGQ2Mjk0NTc5N2ZlZTY2ODAzYmM2MjYwZjY2ZDE4ZjA')
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 113

GET
H/1.1

200
OK

377928.gif
idsync.rlcdn.com/
Redirect Chain

https://d.adroll.com/cm/l/out?advertisable=TQSV74R4GVCSJITSZC2MCP
https://idsync.rlcdn.com/377928.gif?partner_uid=dd62945797fee66803bc6260f66d18f0
https://idsync.rlcdn.com/377928.gif?partner_uid=dd62945797fee66803bc6260f66d18f0&redirect=1

43 B
533 B

104ms
104ms

Image
image/gif

52.1.1.155
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/377928.gif?partner_uid=dd62945797fee66803bc6260f66d18f0&redirect=1
Protocol: HTTP/1.1
Server: 52.1.1.155 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-1-1-155.compute-1.amazonaws.com
Software: /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store
Connection: keep-alive
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Content-Length: 43
Content-Type: image/gif; charset=ISO-8859-1

Redirect headers

Location: https://idsync.rlcdn.com/377928.gif?partner_uid=dd62945797fee66803bc6260f66d18f0&redirect=1
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store
Connection: keep-alive
Content-Type: image/gif; charset=ISO-8859-1
Content-Length: 0
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

GET
H/1.1

200
OK

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?advertisable=TQSV74R4GVCSJITSZC2MCP
https://us-u.openx.net/w/1.0/sd?id=537103138&val=dd62945797fee66803bc6260f66d18f0
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=dd62945797fee66803bc6260f66d18f0

43 B
318 B

19ms
19ms

Image
image/gif

173.241.240.143
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=dd62945797fee66803bc6260f66d18f0
Protocol: HTTP/1.1
Server: 173.241.240.143 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-143.xa.dc.openx.org
Software: OXGW/16.19.2 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: OXGW/16.19.2
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, max-age=0, no-cache
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=dd62945797fee66803bc6260f66d18f0
Date: Thu, 10 May 2018 09:08:05 GMT
Server: OXGW/16.19.2
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

200
OK

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?advertisable=TQSV74R4GVCSJITSZC2MCP&google_nid=adroll2
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=3WKUV5f-5mgDvGJg9m0Y8A&google_ula=1535926
https://d.adroll.com/cm/g/in?google_ula=1535926,0

35 B
490 B

28ms
27ms

Image
image/gif

54.246.127.122
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in?google_ula=1535926,0
Protocol: HTTP/1.1
Server: 54.246.127.122 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-246-127-122.eu-west-1.compute.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: ce4e964329e64bb7128c1c1d602433a744b48f6dbc1212e65b2b5184bd8c6617

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Server: nginx/1.12.1
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
X-Result: g.-1.-1.1535926.0.-1

Redirect headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:05 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in?google_ula=1535926,0
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 246
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

jot.html
platform.twitter.com/ Frame 7153
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

0
0

6ms
5ms

Document
text/html

199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /jot.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: DBAF5153E0E5B4EA5B40D42FAB3E4B4E

Response headers

status: 200
date: Thu, 10 May 2018 09:08:05 GMT
last-modified: Mon, 07 May 2018 22:01:37 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "d9592a6c704736fa4da218d4357976dd+gzip"
content-encoding: gzip
accept-ranges: bytes
via: 1.1 varnish
age: 212703
x-served-by: cache-tw-fra1-cr1-19-TWFRA1
x-cache: HIT
x-timer: S1525943285.243815,VS0,VE0
vary: Accept-Encoding,Host
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 95

Redirect headers

status: 302 302 Found
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
content-type: text/html;charset=utf-8
date: Thu, 10 May 2018 09:08:05 GMT
expires: Tue, 31 Mar 1981 05:00:00 GMT
last-modified: Thu, 10 May 2018 09:08:05 GMT
location: https://platform.twitter.com/jot.html
pragma: no-cache
server: tsa_o
strict-transport-security: max-age=631138519
x-connection-hash: 33503bd10c49e4a14333ac8393bb92f3
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 106
x-transaction: 00bb8abc00f790e7
x-tsa-request-body-time: 1
x-twitter-response-tags: BouncerCompliant
x-xss-protection: 0

GET
H/1.1

200
OK

match
polo-v1.feathr.co/v1/analytics/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=5af40bf4c6fd45000130f864
https://polo-v1.feathr.co/v1/analytics/match?f_id=5af40bf4c6fd45000130f864&ttd_id=756af128-a6db-42f6-a470-67ca427c87c6

43 B
459 B

110ms
109ms

Image
image/gif

23.21.80.160
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polo-v1.feathr.co/v1/analytics/match?f_id=5af40bf4c6fd45000130f864&ttd_id=756af128-a6db-42f6-a470-67ca427c87c6
Protocol: HTTP/1.1
Server: 23.21.80.160 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-23-21-80-160.compute-1.amazonaws.com
Software: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 09:08:05 GMT
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
Vary: User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0,no-cache,no-store
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization
Content-Length: 43

Redirect headers

pragma: no-cache
date: Thu, 10 May 2018 09:08:05 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://polo-v1.feathr.co/v1/analytics/match?f_id=5af40bf4c6fd45000130f864&ttd_id=756af128-a6db-42f6-a470-67ca427c87c6
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 267

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 101ms
101ms Image
image/gif 54.236.81.21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiOjgsImNsaWVudFRpbWVzdGFtcCI6MTUyNTk0MzI4NS41NDIsIm5hbWUiOiJ2aWV3YWJsZTUwMSIsImNyaXRlcmlvbiI6eyJuYW1lIjoiNTAvMSIsInJhdGlvIjowLjUsInRpbWUiOjEwMDB9fV19?crc32c=286509139
Protocol: HTTP/1.1
Server: 54.236.81.21 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-236-81-21.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 105ms
104ms Image
image/gif 54.236.81.21
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTI1OTQzMjgzeDRkY2Q0ZDNhMjgyNWJheDI2NDg5Mzg5IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI5NjY0NDU0MDUzNjQ1NjY4IiwiaW5kZXgiOjksImNsaWVudFRpbWVzdGFtcCI6MTUyNTk0MzI4NS41NjMsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNTI1OTQzMjg0LjUyOSwidG8iOjE1MjU5NDMyODUuNTUxfV19?crc32c=3982097638
Protocol: HTTP/1.1
Server: 54.236.81.21 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-236-81-21.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 May 2018 09:08:05 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

GET
S 200 closeButton.png
i.ubm-us.net/oas/newsletter/ 2 KB
2 KB 10ms
10ms Image
image/png 104.24.120.117
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ubm-us.net/oas/newsletter/closeButton.png
Protocol: SPDY
Server: 104.24.120.117 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4993fb8970cbb80dda24f8295debe6c5dd4b17b8194dc7a5cce23582234fdc0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 09:08:05 GMT
cf-cache-status: HIT
last-modified: Thu, 05 May 2016 15:40:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 418b426019cd64c9-FRA
content-length: 2264
expires: Fri, 11 May 2018 09:08:05 GMT

GET
S 200 imgad
tpc.googlesyndication.com/pagead/ 26 KB
26 KB 7ms
7ms Image
image/png 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDLhLve3AEQARgBMggCMeB5bsgzbA

Requested by

Host: t.co
URL: https://t.co/XK6tlvz48H

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

5b0230af1f9ff22f41de8ae079f9e1ee47bc889cdd520d28333d904959b5d018

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Mon, 07 May 2018 14:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 240377
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
status: 200
cache-control: public, max-age=604800
content-disposition: attachment; filename="image.png"
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 26406
x-xss-protection: 1; mode=block
expires: Mon, 14 May 2018 14:21:48 GMT

GET
S 200 imgad
tpc.googlesyndication.com/pagead/ 2 KB
2 KB 7ms
6ms Image
image/png 172.217.23.129
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDLhNvJfxABGAEyCLwzqkMkUH-i

Protocol

SPDY

Server

172.217.23.129 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS