news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

40 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=818569501&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&utmhid=2124065480&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&utmht=1611384156561&utmac=UA-737537-1&utmcc=__utma%3D1.1210907603.1611384157.1611384157.1611384157.1%3B%2B__utmz%3D1.1611384157.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1089282293&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1210907603.1611384157&jid=1089282293&_v=5.7.2dc&z=818569501 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1210907603.1611384157&jid=1089282293&_v=5.7.2dc&z=818569501&slf_rd=1&random=2226634845

Request Chain 55

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611384156600&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1611384156600%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F01%252F21%252Fmrbminer-cryptojacking-to-bypass-international-sanctions%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611384156600&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&liSync=true

Request Chain 62

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AABBp07AF4sAABEKYrBnyw HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABBp07AF4sAABEKYrBnyw&verifyHash=45216a4fa2210989e2a46ce124ab14ba61277ed0

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/	48 KB 14 KB	19ms 6ms	Document text/html	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / WordPress VIP <https://wpvip.com> Resource Hash a18d1341e9d9b0be2c7092bab19a1630adc1ad7a254d3e6d536a9d13c1e8d9f4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority news.sophos.com :scheme https :path /en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Sat, 23 Jan 2021 06:42:36 GMT content-type text/html; charset=UTF-8 content-length 13335 x-hacker If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header. x-powered-by WordPress VIP <https://wpvip.com> host-header a9130478a60e5f9135f765b23f26593b link <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/72060>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=72060>; rel=shortlink content-encoding gzip x-rq hhn2 103 47 3099 cache-control max-age=300, must-revalidate age 717 x-cache hit vary Accept-Encoding accept-ranges bytes strict-transport-security max-age=31536000
GET H2	200	/ news.sophos.com/_static/	453 KB 198 KB	6ms 5ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6906c618e970bb59fb5a787b726cc847bcfa3ab2e6a963376389f7d6f833a778 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-rq hhn2 102 126 3102 last-modified Tue, 05 Jan 2021 23:19:39 GMT server nginx age 738761 vary Accept-Encoding x-cache hit content-type text/css;charset=utf-8 cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 202598
GET H2	200	/ Show response news.sophos.com/_static/	98 KB 34 KB	16ms 15ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZgbmJmZmRqXEWAK9zIiA= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7eb243627ed4013b84418c9fe94ee3b9907906ace4de00965ff3b3b33a9f151c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-rq hhn2 103 47 3099 last-modified Tue, 08 Dec 2020 22:24:13 GMT server nginx age 10159 vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 34537
GET H2	200	gtm.js Show response www.googletagmanager.com/	93 KB 35 KB	18ms 18ms	Script application/javascript	2a00:1450:4001:820::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7347c9611afcd0f5f2a7eb3aeedd364d8e1ffbd8d13c0afcdfc699f99d400043 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding br vary * cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36090 x-xss-protection 0 pragma no-cache server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	wp-emoji-release.min.js Show response news.sophos.com/wp-includes/js/	14 KB 5 KB	9ms 5ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 3685c3818240f5f390073c7d04f944a5cb5d848093224f3a7888034e8c050eb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-rq hhn2 102 126 3102 last-modified Tue, 08 Dec 2020 22:26:42 GMT server nginx age 3912407 etag W/"5fcffda2-37a6" vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4721 expires Sun, 23 Jan 2022 06:42:36 GMT
GET H2	200	040a829707237b26ea3984dfc4621217 secure.gravatar.com/avatar/	6 KB 6 KB	20ms 5ms	Image image/jpeg	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/040a829707237b26ea3984dfc4621217?s=145&d=blank&r=g Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6acebd5479915dc29a385217a7b083c6e91f6df4c38377f40fdcbdfe4c4a84ee Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 23 Jan 2021 06:42:36 GMT last-modified Mon, 08 Feb 2016 09:36:55 GMT server nginx content-type image/jpeg access-control-allow-origin * cache-control max-age=300 content-disposition inline; filename="040a829707237b26ea3984dfc4621217.jpeg" accept-ranges bytes link <https://www.gravatar.com/avatar/040a829707237b26ea3984dfc4621217?s=145&d=blank&r=g>; rel="canonical" content-length 6131 expires Sat, 23 Jan 2021 06:47:36 GMT
GET H2	200	216532880604c8cf0600f4bc964cf01d secure.gravatar.com/avatar/	38 KB 38 KB	24ms 10ms	Image image/png	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/216532880604c8cf0600f4bc964cf01d?s=145&d=blank&r=g Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a2e508d4cd7d28288c388909263374730a15769f3d53044334c9c25681c512e1 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 23 Jan 2021 06:42:36 GMT last-modified Mon, 04 Jun 2018 15:39:21 GMT server nginx content-type image/png access-control-allow-origin * cache-control max-age=300 content-disposition inline; filename="216532880604c8cf0600f4bc964cf01d.png" accept-ranges bytes link <https://www.gravatar.com/avatar/216532880604c8cf0600f4bc964cf01d?s=145&d=blank&r=g>; rel="canonical" content-length 38593 expires Sat, 23 Jan 2021 06:47:36 GMT
GET H2	200	facebook-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	600 B 906 B	160ms 56ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/facebook-icon.svg?la=en&hash=1CA0A5A0E9C9999E7E079A5D32C86E9BF9C7AD1E Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash c87eb0c349fe4518e3ffd3d05b3f43f90d4f8709eb7f9924e74e858a6efdb6ed Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 1826, 1826, 1874 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 31, 31, 0 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 395 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:34:25 GMT x-frame-options SAMEORIGIN date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=218 expires Sat, 23 Jan 2021 06:46:14 GMT
GET H2	200	instagram-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	2 KB 1 KB	161ms 56ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/instagram-icon.svg?la=en&hash=2B50C2B67C3023D9E7D4E1C3A16401EAD8F10F76 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash 9f67d83d034c658809bf7a06ff6d74a417ea25a0005f4561abd5254652b6d7c6 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 855, 855, 855 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 31, 33, 31 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 990 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:37:54 GMT x-frame-options SAMEORIGIN date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=440 expires Sat, 23 Jan 2021 06:49:56 GMT
GET H2	200	linkedin-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	923 B 1 KB	160ms 56ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/linkedin-icon.svg?la=en&hash=B6D5378C1E1A16F239A4C862EAE3499B8EC1F3F9 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash c6f378c4d31ede24622009dc2d5e85386926ea9881e94326252146bff0fd5110 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 536, 536, 536, 583, 536 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 5, 37, 5, 0, 5 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 516 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:13 GMT x-frame-options SAMEORIGIN date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=653 expires Sat, 23 Jan 2021 06:53:29 GMT
GET H2	200	rss-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	461 B 913 B	180ms 76ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/rss-icon.svg?la=en&hash=76C4DAFD331DC675814191A66794A778D8C6DCF7 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash b7c9fd97a3a7165755766cd3ba55676f6505642b8c522d89d6f0ab0cabaaa8d7 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 213, 213, 213, 213, 213 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 31, 1, 117, 0 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 305 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:16 GMT x-frame-options SAMEORIGIN date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=540 expires Sat, 23 Jan 2021 06:51:36 GMT
GET H2	200	twitter-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	1 KB 1 KB	180ms 76ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/twitter-icon.svg?la=en&hash=9A90D9F99ABE6454741BBAAF9C3FB6966624C92D Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash 52600b30637371871a7d5d50ba86cb9a29ad65d75a78824b4daba442c4eee113 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 236, 236, 299, 236, 236 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 31, 31, 0, 37, 43 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 582 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:19 GMT x-frame-options SAMEORIGIN date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=637 expires Sat, 23 Jan 2021 06:53:13 GMT
GET H2	200	youtube-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	792 B 1 KB	191ms 88ms	Image image/svg+xml	104.108.55.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/youtube-icon.svg?la=en&hash=CCCF647AFA78C8DB74D654DB9FEFBF0AC54F42D3 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.55.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-55-47.deploy.static.akamaitechnologies.com Software / Resource Hash 0ce7b19357902318f5e2db207e64647d6a78d7f9f620ef55a8a07ad2f8e6d798 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 2027, 2027, 2078, 2027, 2027, 2027 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 31, 33, 0, 32, 31, 37 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 426 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 16 May 2019 15:01:23 GMT x-frame-options SAMEORIGIN date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=677 expires Sat, 23 Jan 2021 06:53:53 GMT
GET H2	200	/ Show response news.sophos.com/_static/	140 KB 40 KB	6ms 5ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyVkMEOgyAMhl9ogBqnp2WPsjDsFKVAKMzt7cdiTHbYQZJe+vf72qRi9Uw5G8FGESdAIEHOT44srMSaqu7FTLky5BYN7Nnwhtc54FvAZzqJQzuUCwU0vGKQdJzfIp6iNuWWkuilHm2x6GWIFkKxN8pi5ZvtkrbKpAFoeytiXsACePPmqO0/KLeAdxh+5/tlTMybNGpLQi6aEKK4ZVc8XMDMXvFSd1Xfdl1zbucPbWbKFw== Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7a7dadc7ff2068d9772a91502491eefdd1a6affb4d31da24a90c15937dc2070d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-rq hhn2 102 104 3107 last-modified Wed, 30 Dec 2020 14:58:53 GMT server nginx age 716 vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 41205
GET H2	200	e-202103.js Show response stats.wp.com/	9 KB 3 KB	84ms 27ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202103.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT ams date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip server nginx etag W/"5c6340e3-350a" vary Accept-Encoding content-type application/javascript cache-control max-age=31536000 expires Sun, 09 Jan 2022 23:21:12 GMT
GET H2	200	footer.css news.sophos.com/wp-content/themes/sophosnews-2017/	3 KB 1014 B	6ms 6ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/footer.css Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 29e135bc96ba3ec4a643931a8ef458e48aa372894da5c635433993ea961ab7ae Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-rq hhn2 102 104 3087 last-modified Sat, 31 Oct 2020 08:56:19 GMT server nginx age 6820465 etag W/"5f9d26b3-a6e" vary Accept-Encoding x-cache hit content-type text/css cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 880 expires Sun, 23 Jan 2022 06:42:36 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f81f3b44c5da8f8b9b365294b2146763d666b9f445e1b2285466910d5361cec5 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	435 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 011ee00e2221fd2994156f01b85251391099270cc849857806d6a249481c90ff Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	342 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b0348edeb29dc1accfecb54a863c8597ea124c1ab9f1a38f3b9e12e953364a05 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	518 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1875cad468466b9b4ea2ebd196b8969f905ab31c20cd5e0a0c2da9b37fa12095 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c8fa9e46358747cc949be0709256687b7ac1f8fd295f0de4073b11a41c534b62 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	469 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04029edaf619462965453e8ac9cf74c584b1ef526c95f71185acc63a696b7f1c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	665 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f2792fa9c99f81eaf3035f2ba7634dd84f42526df8a1f31196912de7e55c815e Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	349 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3f510f8a21c09db2bb8f964b3e424fce6a77aea73ac791e9c0c6b8b238405366 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	515 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 633210530499824ad06b2b30a04a9ee18b4b8e2071620691a58c9a476dc728b9 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H2	200	mykings_intro_art.png news.sophos.com/wp-content/uploads/2020/07/	27 KB 27 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/07/mykings_intro_art.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 52faf754d00fd2852d42afcedf85423b1352b1ff21ae330c2c7a7bea2929b5b2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 88 443 last-modified Thu, 21 Jan 2021 13:42:39 GMT server nginx etag "a211a55f268d99e0" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 27650 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	sophoslabs-kingminer-botnet-report-1200x628-blank.jpg news.sophos.com/wp-content/uploads/2020/06/	20 KB 20 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/06/sophoslabs-kingminer-botnet-report-1200x628-blank.jpg?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a06f1a80ad787641ae81d3c1580b8bc1a219fe39d03d9b62aa259b1ff32fb8c0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 83 443 last-modified Mon, 28 Dec 2020 06:24:46 GMT server nginx etag "df491b39be3b148e" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 20592 expires Tue, 28 Dec 2021 06:24:46 GMT
GET H2	200	tay-plus-data-no-text.png news.sophos.com/wp-content/uploads/2019/12/	116 KB 116 KB	8ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2019/12/tay-plus-data-no-text.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bd9133b334088f8ef0dcb005010db5241567305f4782e1bb4c69116bbfc35cf3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 200 443 last-modified Thu, 05 Nov 2020 10:27:38 GMT server nginx etag "dfc79953019c9107" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 118548 expires Fri, 05 Nov 2021 10:27:38 GMT
GET H2	200	iot-devices-apps.jpg news.sophos.com/wp-content/uploads/2019/02/	98 KB 98 KB	9ms 9ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2019/02/iot-devices-apps.jpg?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bcbb1bfac289ea9d5ccd2c6f6900e3a87a35645c3464af5122de090945982aaa Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 196 443 last-modified Sat, 16 Jan 2021 00:23:49 GMT server nginx etag "a78cad4a03cb938c" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 100430 expires Sun, 16 Jan 2022 00:23:49 GMT
GET H2	200	SophosSans-Regular.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	24 KB 25 KB	9ms 8ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Regular.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c1da7a3d76f2fd71ba637d968b49556520ee94d72a5b60a5d21f34f5e4029ec4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 103 47 3099 last-modified Thu, 29 Oct 2020 17:01:28 GMT server nginx age 25 etag "5f9af568-61bc" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 25020 expires Sun, 23 Jan 2022 06:42:36 GMT
GET H2	200	SophosSans-Light.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	25 KB 25 KB	9ms 9ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 98 168 3104 last-modified Mon, 11 Jan 2021 23:11:24 GMT server nginx age 25 etag "5ffcdb1c-62e4" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 25316 expires Sun, 23 Jan 2022 06:42:36 GMT
GET H2	200	SophosSans-Medium.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	10ms 10ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 103 47 3099 last-modified Thu, 29 Oct 2020 17:01:28 GMT server nginx age 25 etag "5f9af568-67a4" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 26532 expires Sun, 23 Jan 2022 06:42:36 GMT
GET H2	200	SophosSans-Semibold.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	11ms 11ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.3/css/jetpack.css?m=1609888784 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 102 126 3102 last-modified Sun, 01 Nov 2020 13:44:25 GMT server nginx age 25 etag "5f9ebbb9-6828" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 26664 expires Sun, 23 Jan 2022 06:42:36 GMT
GET H2	200	cryptomining.jpg news.sophos.com/wp-content/uploads/2018/03/	169 KB 170 KB	8ms 5ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2018/03/cryptomining.jpg?resize=768,402 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 144b332f7e3431103b4eb70b26e14c144e7b8b84fd31d6e05f0f2159159b40c4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 84 443 last-modified Thu, 21 Jan 2021 13:42:38 GMT server nginx etag "751ffe495568e7e8" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 173380 expires Fri, 21 Jan 2022 13:42:38 GMT
GET H2	200	mrbminer-commandline.png news.sophos.com/wp-content/uploads/2021/01/	22 KB 22 KB	9ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/mrbminer-commandline.png?resize=768,74 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0a3f7d4118ab33652810850403c87b985307ba4f4b4b2031b6aa4eb44b1f12e4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 84 443 last-modified Thu, 21 Jan 2021 13:42:39 GMT server nginx etag "6b0c2901301845b9" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 22356 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	20210115_mrbminer_image1_logo.png news.sophos.com/wp-content/uploads/2021/01/	80 KB 80 KB	9ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/20210115_mrbminer_image1_logo.png?resize=1024,480 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6decdd4bdc0297c5bf881a0ebf6502312fd44c1109f91c77d6aaaa132d7fbd05 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 83 443 last-modified Thu, 21 Jan 2021 13:42:39 GMT server nginx etag "2c96a2bdb284a71c" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 82022 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	20210115_mrbminer_image2_logo.png news.sophos.com/wp-content/uploads/2021/01/	18 KB 18 KB	10ms 8ms	Image image/png	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/20210115_mrbminer_image2_logo.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 50e79fe6df90fae24496736b779f9ca6720ba4fcb51b33a5f0144705fd4e6604 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 84 443 last-modified Wed, 20 Jan 2021 20:26:30 GMT server nginx etag "587f7f61c3d6f440" strict-transport-security max-age=31536000 x-cache HIT content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 18146 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	20210115_mrbminer_image5_logo.png news.sophos.com/wp-content/uploads/2021/01/	38 KB 38 KB	10ms 9ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/20210115_mrbminer_image5_logo.png?resize=768,180 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a3dec69cdff845f09284f65f9a5b27843d9df43141797360cfb77b0b98293b06 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 140 443 last-modified Thu, 21 Jan 2021 13:42:39 GMT server nginx etag "b7180260f164ca60" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 38452 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	mrbminer-relationship-map-vt-graph-logo.png news.sophos.com/wp-content/uploads/2021/01/	97 KB 98 KB	11ms 10ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/mrbminer-relationship-map-vt-graph-logo.png?resize=768,489 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9387f7cb19029dfe781e18bdcc284d0c0f7318244d584e38129fa1285a3f8a94 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 83 443 last-modified Thu, 21 Jan 2021 13:42:39 GMT server nginx etag "c30afcdd91568105" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 99804 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	20210115_mrbminer_image7_logo-1.png news.sophos.com/wp-content/uploads/2021/01/	32 KB 32 KB	12ms 11ms	Image image/png	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/20210115_mrbminer_image7_logo-1.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b1d0619e8d488ddcea9a66cf523ac62359b1421f64b7a197518092abc9ef3567 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 140 443 last-modified Wed, 20 Jan 2021 20:44:38 GMT server nginx etag "3d63e71275d3d918" strict-transport-security max-age=31536000 x-cache HIT content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 32365 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	20210115_mrbminer_image6_logo.png news.sophos.com/wp-content/uploads/2021/01/	26 KB 27 KB	12ms 11ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/01/20210115_mrbminer_image6_logo.png?resize=768,136 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7e0e597960ce86ea0972c25b5991d0843b7f2ae29d156a623ad6fc24069937e6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT x-rq hhn2 109 142 443 last-modified Thu, 21 Jan 2021 13:42:39 GMT server nginx etag "feed4117c33eea6d" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 27064 expires Fri, 21 Jan 2022 13:42:39 GMT
GET H2	200	dc.js Show response stats.g.doubleclick.net/	45 KB 17 KB	13ms 12ms	Script text/javascript	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/dc.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVkMEOgyAMhl9ogBqnp2WPsjDsFKVAKMzt7cdiTHbYQZJe+vf72qRi9Uw5G8FGESdAIEHOT44srMSaqu7FTLky5BYN7Nnwhtc54FvAZzqJQzuUCwU0vGKQdJzfIp6iNuWWkuilHm2x6GWIFkKxN8pi5ZvtkrbKpAFoeytiXsACePPmqO0/KLeAdxh+5/tlTMybNGpLQi6aEKK4ZVc8XMDMXvFSd1Xfdl1zbucPbWbKFw== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 890 date Sat, 23 Jan 2021 06:27:46 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17093 expires Sat, 23 Jan 2021 08:27:46 GMT
GET H/1.1	200 OK	elqCfg.min.js Show response img03.en25.com/i/	6 KB 3 KB	102ms 35ms	Script application/x-javascript	104.111.229.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img03.en25.com/i/elqCfg.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVkMEOgyAMhl9ogBqnp2WPsjDsFKVAKMzt7cdiTHbYQZJe+vf72qRi9Uw5G8FGESdAIEHOT44srMSaqu7FTLky5BYN7Nnwhtc54FvAZzqJQzuUCwU0vGKQdJzfIp6iNuWWkuilHm2x6GWIFkKxN8pi5ZvtkrbKpAFoeytiXsACePPmqO0/KLeAdxh+5/tlTMybNGpLQi6aEKK4ZVc8XMDMXvFSd1Xfdl1zbucPbWbKFw== Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.229.66 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-229-66.deploy.static.akamaitechnologies.com Software / Resource Hash 6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 2115 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Fri, 16 Oct 2020 14:38:37 GMT Date Sat, 23 Jan 2021 06:42:36 GMT Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-cache, no-store ETag "ee5a418caa3d61:0" Accept-Ranges bytes Expires Sat, 23 Jan 2021 06:42:36 GMT
GET H2	200	g.gif pixel.wp.com/	50 B 92 B	28ms 27ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&j=1%3A9.3.1&blog=166161023&post=72060&tz=-5&srv=news.sophos.com&host=news.sophos.com&ref=&fcp=201&rand=0.22255135356728628 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=818569501&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=2... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1210907603.1611384157&jid=1089282293&_v=5.7.2dc&z=818569501 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1210907603.1611384157&jid=1089282293&_v=5.7.2dc&z=818569501&slf_rd=1&random=2226634845	42 B 505 B	43ms 23ms	Image image/gif	2a00:1450:4001:81e::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1210907603.1611384157&jid=1089282293&_v=5.7.2dc&z=818569501&slf_rd=1&random=2226634845 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 23 Jan 2021 06:42:36 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Sat, 23 Jan 2021 06:42:36 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1210907603.1611384157&jid=1089282293&_v=5.7.2dc&z=818569501&slf_rd=1&random=2226634845 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	__utm.gif stats.g.doubleclick.net/r/	35 B 92 B	29ms 16ms	Image image/gif	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1145097539&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&utmhid=2124065480&utmr=-&utmp=%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&utmht=1611384156566&utmac=UA-737537-53&utmcc=__utma%3D204943247.338383705.1611384157.1611384157.1611384157.1%3B%2B__utmz%3D204943247.1611384157.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1922937002&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Sat, 23 Jan 2021 06:42:36 GMT content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	98 KB 39 KB	42ms 28ms	Script application/javascript	2a00:1450:4001:820::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-743773256 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 415257fd12f355bb17dbfdd4c04023aa3c8df1f96eb9e324717e9abf0e2f4cce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39679 x-xss-protection 0 last-modified Sat, 23 Jan 2021 06:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 23 Jan 2021 06:42:36 GMT
GET H2	200	bat.js Show response bat.bing.com/	27 KB 9 KB	43ms 28ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip last-modified Tue, 20 Oct 2020 22:19:32 GMT x-msedge-ref Ref A: C389F1C9096E49C58366D721E6224286 Ref B: FRAEDGE1521 Ref C: 2021-01-23T06:42:36Z etag "0b27f152fa7d61:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 8454
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	91 KB 23 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23762 x-fb-rlafr 0 pragma public x-fb-debug 4+KvnplwjMS6KnfkI9/r781Qz0xqsn4vumDUv7swMWrnS2FWKASASEchjoL58iWGxygbBdKuG0OtfCUNRkxgSw== x-fb-trip-id 917726464 x-frame-options DENY cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Sat, 23 Jan 2021 06:42:36 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	20ms 6ms	Script application/x-javascript	2a02:26f0:6c00:295::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:295::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 23 Jan 2021 06:42:36 GMT Content-Encoding gzip Last-Modified Mon, 04 Jan 2021 22:14:03 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=66319 Connection keep-alive Accept-Ranges bytes Content-Length 1855
GET H2	200	WuEFNglz.min.js Show response scripts.demandbase.com/	60 KB 16 KB	182ms 39ms	Script application/javascript	65.9.67.117 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/WuEFNglz.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.67.117 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 058b79d96bbf2a9f0558efaff44f70126cb2f5e73d8758d0f9b86ea1672d642e Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id HYpIheFF8jWD1XlX2mxVztFQbf3DVt6K content-encoding gzip last-modified Wed, 20 Jan 2021 13:33:48 GMT server AmazonS3 age 1881 etag W/"94d0160d80ec0ee1a85a3b9515452619" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 e39402e2cf62b31f7774452c905f38f3.cloudfront.net (CloudFront) cache-control public, max-age=3600 date Sat, 23 Jan 2021 06:11:16 GMT x-amz-cf-pop FRA56-C1 x-amz-cf-id nXPjgDYql9HWH238usISgh8dklkyovgX0n7CxtNQBze76yw4lH1i9A==
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	97ms 30ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT via 1.1 varnish last-modified Fri, 04 Dec 2020 00:21:46 GMT age 24239 etag "cbc512946c8abb461c6215ed5b454e5f+gzip" vary Accept-Encoding,Host x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-encoding gzip cache-control no-cache accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 1957 x-timer S1611384157.663165,VS0,VE0 x-served-by cache-fra19126-FRA
GET H2	200	qevents.js Show response a.quora.com/	39 KB 14 KB	96ms 30ms	Script text/plain	151.101.113.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://a.quora.com/qevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.113.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id s3LlaOWABX1LUjiLldBNr49lVAylKDRo content-encoding gzip etag "f32ebb1e93a72c0a57add6d07f688510" age 505 x-cache HIT, HIT content-length 13681 x-amz-id-2 U/wbj1Y9/fQV5c85rNiTRBQbTitQ5lxTwraA2vyxW66USqxyZ+aF40eURihseuRjR9febIOPx6Q= x-served-by cache-bwi5132-BWI, cache-hhn4080-HHN last-modified Fri, 25 Oct 2019 19:28:38 GMT server AmazonS3 x-amz-meta-s3cmd-attrs atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou x-timer S1611384157.661023,VS0,VE0 date Sat, 23 Jan 2021 06:42:36 GMT vary Accept-Encoding x-amz-request-id 1J1RES1MFN9S2G1Y via 1.1 varnish, 1.1 varnish cache-control max-age=7200 accept-ranges bytes content-type text/plain x-cache-hits 1, 96
GET H/1.1	200 OK	events.js Show response tags.srv.stackadapt.com/	13 KB 5 KB	431ms 108ms	Script text/javascript	34.233.235.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/events.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.233.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-233-235-75.compute-1.amazonaws.com Software / Resource Hash a38ef1808644355aac264c71a1bbefa45ce14b569fa7e9c8825360b377b04594 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Sat, 23 Jan 2021 06:42:36 GMT Content-Encoding gzip Cache-Control max-age=30 Content-Length 4295 Connection keep-alive Content-Type text/javascript
GET H/1.1	200 OK	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	5 KB 6 KB	119ms 29ms	Script application/x-javascript	205.185.216.10 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS map2.hwcdn.net Software / Resource Hash 20b11d2c0012e286c38350d6c9b2ba03341667d9bc7226bf526fb47e89668fd9 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 23 Jan 2021 06:42:36 GMT Connection Keep-Alive Last-Modified Fri, 18 Dec 2020 19:31:32 GMT x-amz-request-id tx0000000000000a6578216-00600bb9b0-2cef14a-sfo2a ETag "23752d527a82df9be63eb97fe04bceb3" Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1611384156.dop209.sk1.t,1611384156.cds022.sk1.shn,1611384156.cds022.sk1.c Content-Type application/x-javascript Cache-Control max-age=601812 x-rgw-object-type Normal Strict-Transport-Security max-age=15552000; includeSubDomains; preload Accept-Ranges bytes Content-Length 5105
GET H2	200	334990480506518 Show response connect.facebook.net/signals/config/	241 KB 69 KB	8ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/334990480506518?v=2.9.33&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 63eec650cb50ca3b4b97aa50ce43ad109810adbb6ac36be57cbe98c319f9e85d Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 70639 x-fb-rlafr 0 pragma public x-fb-debug JNcgkE6zjKcPCEF1K5w/krx51LnaCrUbmkms0nzHKyQ9/yzzQ+1qtGpa33s/WIlLpkMSJXmK26JH1gVzZqCD0Q== x-fb-trip-id 917726464 x-frame-options DENY date Sat, 23 Jan 2021 06:42:36 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-content-id 1346959260 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611384156600&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1611384156600%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611384156600&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F...	0 81 B	623ms 622ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611384156600&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&liSync=true Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:38 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 0 x-li-uuid pz1BkFrJXBZQjQiFPCsAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-content-type-options nosniff linkedin-action 1 content-length 0 x-li-uuid fvsAiFrJXBYAHZnfoysAAA== pragma no-cache x-li-pop afd-prod-esv5 x-msedge-ref Ref A: 7FF825C1105947F7B8F823BC5D6CECD0 Ref B: FRAEDGE1119 Ref C: 2021-01-23T06:42:37Z x-frame-options sameorigin date Sat, 23 Jan 2021 06:42:37 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=31536000 x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1611384156600&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&liSync=true cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 261 B	6ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&rl=&if=false&ts=1611384156627&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1611384156625.1848939964&it=1611384156597&coo=false&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Sat, 23 Jan 2021 06:42:36 GMT
GET H2	204	0 bat.bing.com/action/	0 147 B	30ms 29ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=eccada0c-22e6-4eef-bbf5-d41fe310d337&sid=2e08de105d4611eba62911c0f7e15bf5&vid=2e08f5905d4611ebbc230b49a1a267c6&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&r=&lt=287&evt=pageLoad&msclkid=N&sv=1&rn=249147 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Sat, 23 Jan 2021 06:42:36 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 7630E278BF364EA8A0A20F2559A8B194 Ref B: FRAEDGE1521 Ref C: 2021-01-23T06:42:36Z expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	30 KB 13 KB	168ms 71ms	Script text/javascript	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 34fcae3cf94e02d46c230a5b7dd3827d612587164e048dcfe146518da1cb4ab0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 12189 x-xss-protection 0 server cafe etag 8926089356025331971 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Sat, 23 Jan 2021 06:42:36 GMT
GET H2	200	adsct t.co/i/	43 B 449 B	251ms 157ms	Image image/gif	104.244.42.5 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 111 pragma no-cache last-modified Sat, 23 Jan 2021 06:42:36 GMT server tsa_f x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 4f0e802c7b7bd6a9221618160a54fa28 x-transaction 00afd965008b724d expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	pixel q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/	43 B 421 B	430ms 108ms	Image image/gif	3.213.100.238 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&tag=ViewContent&ts=1611384156700 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.100.238 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-100-238.compute-1.amazonaws.com Software nginx / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 23 Jan 2021 06:42:37 GMT Server nginx Connection keep-alive Content-Length 43 Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Q-Stat ,d9314611ca022780e8f6abb408bd8c4b,10.0.0.113,4894,82.102.20.235,,60720743245,1,1611384157.071,0.001,,.,0,0,0.000,0.000,-,0,0,197,285,142,10,26847,,,,,,-, Content-Type image/gif
GET H2	200	ip.json Show response api.company-target.com/api/v2/	436 B 937 B	149ms 83ms	XHR application/json	65.9.73.96 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&page_title=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7 Requested by Host: scripts.demandbase.com URL: https://scripts.demandbase.com/WuEFNglz.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.73.96 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 0d24e9923edbf8af778b0e4b424f25f68e5eaf62a395eb7a2242206bf4955b30 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT identification-source CENTRAL vary Accept-Encoding, Origin x-amz-cf-pop AMS1-C1 x-cache Miss from cloudfront request-id 0d4793e0-7e61-40cf-b606-93081910303a content-encoding gzip pragma no-cache access-control-allow-origin https://news.sophos.com server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 9385401cebb473e4ed1da6c81b927c52.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id q5SjrcgmWL0Jf8BxoWA7QyWkeXpzuf6Ia0q9inTDd5BJerLat5K1Tw== expires Fri, 22 Jan 2021 06:42:36 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AABBp07AF4sAABEKYrBnyw https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABBp07AF4sAABEKYrBnyw&verifyHash=45216a4fa2210989e2a46ce124ab14ba61277ed0	26 B 409 B	124ms 123ms	Image image/gif	65.9.67.52 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABBp07AF4sAABEKYrBnyw&verifyHash=45216a4fa2210989e2a46ce124ab14ba61277ed0 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 65.9.67.52 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 23 Jan 2021 06:42:37 GMT Via 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA56-C1 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id 46e953606826011c X-Amz-Cf-Id ZKY2RCilY26DqJk90kcHlpvO2EkCwNpt2o8ElPBdmQt5Z91tU_5Odg== Redirect headers Date Sat, 23 Jan 2021 06:42:37 GMT Via 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA56-C1 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AABBp07AF4sAABEKYrBnyw&verifyHash=45216a4fa2210989e2a46ce124ab14ba61277ed0 Connection keep-alive trace-id 5569fd7a09c1cc1f Content-Length 0 X-Amz-Cf-Id LmBOCwvGtGLRghSFfYX1G9lNI5aE1WqDhCbSv7hQwWDJN8vUY9e_xw==
GET H2	451	464526.gif id.rlcdn.com/	0 66 B	113ms 55ms	Image text/plain	34.120.207.148 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://id.rlcdn.com/464526.gif Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.207.148 , United States, ASN15169 (GOOGLE, US), Reverse DNS 148.207.120.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:36 GMT via 1.1 google alt-svc clear content-length 0
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/	2 KB 2 KB	51ms 31ms	Script text/javascript	2a00:1450:4001:817::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1611384156834&cv=9&fst=1611384156834&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&tiba=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 355c3edd29cff5290e1728e95fdd662d71001893095864e360a3abf8dce1ae7b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 23 Jan 2021 06:42:36 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1104 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/743773256/	42 B 530 B	41ms 27ms	Image image/gif	2a00:1450:4001:801::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/743773256/?random=1611384156834&cv=9&fst=1611381600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&tiba=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1073420099&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 23 Jan 2021 06:42:36 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/743773256/	42 B 530 B	48ms 35ms	Image image/gif	2a00:1450:4001:81e::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/743773256/?random=1611384156834&cv=9&fst=1611381600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&tiba=MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1073420099&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Sat, 23 Jan 2021 06:42:36 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	sa.css tags.srv.stackadapt.com/	82 B 309 B	109ms 107ms	Stylesheet text/css	34.233.235.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.css Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.233.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-233-235-75.compute-1.amazonaws.com Software / Resource Hash 4fefa04662fa1f366b7cbfecc2c2b313c3800eb3ffaba4745625fd5b75ff4441 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Sat, 23 Jan 2021 06:42:37 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 82 Content-Type text/css
GET H/1.1	200 OK	sa.jpeg Show response tags.srv.stackadapt.com/	0 881 B	431ms 108ms	Fetch image/jpeg	34.233.235.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.jpeg Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.233.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-233-235-75.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Sat, 23 Jan 2021 06:42:37 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 651 Content-Type image/jpeg
GET H2	200	/ www.facebook.com/tr/	44 B 149 B	7ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&rl=&if=false&ts=1611384157136&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22MrbMiner%3A%20Cryptojacking%20to%20bypass%20international%20sanctions%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F%22%2C%22og%3Adescription%22%3A%22Iran-based%20%E2%80%9Cgarage%20startup%E2%80%9D%20cryptojacking%20operation%20targets%20SQL%20servers%22%2C%22article%3Apublished_time%22%3A%222021-01-21T13%3A30%3A23%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-01-21T15%3A42%3A51%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2018%2F03%2Fcryptomining.jpg%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2018%2F03%2Fcryptomining.jpg%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22335%22%2C%22og%3Aimage%3Aalt%22%3A%22cryptomining%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1611384156625.1848939964&it=1611384156597&coo=false&es=automatic&tm=3&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:37 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Sat, 23 Jan 2021 06:42:37 GMT
GET H/1.1	200 OK	saq_pxl Show response tags.srv.stackadapt.com/	94 B 397 B	110ms 108ms	XHR text/plain	34.233.235.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&host=https://news.sophos.com&sa_conv_data_css_value=%20%220-9937895e-a8e8-4f1c-5197-dd3f7c3bbba9%24ip%2482.102.20.235%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd947ce83ee2801406e626d60b5ebf5119c526614eb Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.233.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-233-235-75.compute-1.amazonaws.com Software / Resource Hash 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 23 Jan 2021 06:42:37 GMT Access-Control-Allow-Methods GET Content-Type text/plain; charset=utf-8 Access-Control-Allow-Origin https://news.sophos.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 94
GET H/1.1	204 No Content	js_tracking Show response tags.srv.stackadapt.com/	0 250 B	218ms 107ms	XHR text/plain	34.233.235.75 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/js_tracking?url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F&uid=uxMvfKEouJZfJzsjwRVn_Q&host=https://news.sophos.com Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.233.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-233-235-75.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin https://news.sophos.com Date Sat, 23 Jan 2021 06:42:37 GMT Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Access-Control-Allow-Methods GET
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 652 B	236ms 154ms	Script application/javascript	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F01%2F21%2Fmrbminer-cryptojacking-to-bypass-international-sanctions%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/01/21/mrbminer-cryptojacking-to-bypass-international-sanctions/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 06:42:38 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 114 pragma no-cache last-modified Sat, 23 Jan 2021 06:42:38 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash d347f4d6960bc97323e3c7ffb538a48f x-transaction 002fd1970095e160 expires Tue, 31 Mar 1981 05:00:00 GMT