nakedsecurity.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital
Effective URL:
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Submission: On April 28 via manual (April 28th 2022, 3:58:11 am UTC) from JP — Scanned from JP

Summary HTTP 85 Redirects Links 49 Behaviour Indicators

Summary

This website contacted 30 IPs in 8 countries across 29 domains to perform 85 HTTP transactions. The main IP is 2a04:fa87:fffd::c000:42c8, located in Ireland and belongs to AUTOMATTIC, US. The main domain is nakedsecurity.sophos.com. The Cisco Umbrella rank of the primary domain is 162083.
TLS certificate: Issued by R3 on April 8th 2022. Valid for: 3 months.

This is the only time nakedsecurity.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 21	2a04:fa87:fff... 2a04:fa87:fffd::c000:42c8	2635 (AUTOMATTIC) (AUTOMATTIC)
16	23.36.105.121 23.36.105.121	16625 (AKAMAI-AS) (AKAMAI-AS)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2404:6800:400... 2404:6800:4004:81f::2008	15169 (GOOGLE) (GOOGLE)
2 3	2404:6800:400... 2404:6800:4004:822::2008	15169 (GOOGLE) (GOOGLE)
1	184.26.249.60 184.26.249.60	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f00... 2a03:2880:f00f:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	2600:140b:2::... 2600:140b:2::174d:ccb0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	143.204.73.109 143.204.73.109	16509 (AMAZON-02) (AMAZON-02)
1	151.101.108.157 151.101.108.157	54113 (FASTLY) (FASTLY)
1	151.101.193.2 151.101.193.2	54113 (FASTLY) (FASTLY)
4	34.193.254.175 34.193.254.175	14618 (AMAZON-AES) (AMAZON-AES)
2	13.225.163.123 13.225.163.123	16509 (AMAZON-02) (AMAZON-02)
2	2406:2000:a4:... 2406:2000:a4:9fe::	10230 (YAHOO-SG ...) (YAHOO-SG internet content provider)
2 2	2404:6800:400... 2404:6800:4008:c13::9d	15169 (GOOGLE) (GOOGLE)
2 3	2404:6800:400... 2404:6800:4004:813::2004	15169 (GOOGLE) (GOOGLE)
3	2404:6800:400... 2404:6800:4004:801::2003	15169 (GOOGLE) (GOOGLE)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	104.18.101.194 104.18.101.194	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	106.10.236.146 106.10.236.146	56173 (YAHOO-SG3...) (YAHOO-SG3 internet content provider)
1	54.204.196.80 54.204.196.80	14618 (AMAZON-AES) (AMAZON-AES)
1 2	172.217.161.66 172.217.161.66	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f10... 2a03:2880:f10f:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3 8	65.9.42.87 65.9.42.87	16509 (AMAZON-02) (AMAZON-02)
1	143.204.73.11 143.204.73.11	16509 (AMAZON-02) (AMAZON-02)
2 2	13.114.99.218 13.114.99.218	16509 (AMAZON-02) (AMAZON-02)
2 2	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:827::2002	15169 (GOOGLE) (GOOGLE)
3	52.224.31.34 52.224.31.34	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	52.231.207.240 52.231.207.240	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 5	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 1	18.178.52.42 18.178.52.42	16509 (AMAZON-02) (AMAZON-02)
1 1	8.39.36.141 8.39.36.141	26667 (RUBICONPR...) (RUBICONPROJECT)
85	30

21 2a04:fa87:fffd::c000:42c8 (Ireland) 2 redirects

ASN2635 (AUTOMATTIC, US)

nakedsecurity.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 23.36.105.121 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-105-121.deploy.static.akamaitechnologies.com

www.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:81f::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:822::2008 (Australia) 2 redirects

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.26.249.60 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-26-249-60.deploy.static.akamaitechnologies.com

img03.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f00f:8:face:b00c:0:1 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:2::174d:ccb0 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.73.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-73-109.nrt12.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.108.157 (Tokyo, Japan)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.2 (United States)

ASN54113 (FASTLY, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.193.254.175 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-254-175.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.163.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-163-123.nrt12.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2406:2000:a4:9fe:: (Taiwan)

ASN10230 (YAHOO-SG internet content provider, SG)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4008:c13::9d (Taipei, Taiwan) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:813::2004 (Australia) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:801::2003 (Australia)

ASN15169 (GOOGLE, US)

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.101.194 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

p.adsymptotic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 106.10.236.146 (Singapore, Singapore)

ASN56173 (YAHOO-SG3 internet content provider, SG)
PTR: spdc.pbp.vip.sg3.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.204.196.80 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-196-80.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.161.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt20s09-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f10f:83:face:b00c:0:25de (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 65.9.42.87 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: server-65-9-42-87.nrt12.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.73.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-73-11.nrt12.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.114.99.218 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-114-99-218.ap-northeast-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:827::2002 (Australia)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.224.31.34 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

h.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.231.207.240 (Busan, Korea, Republic Of) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.33.220.150 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.178.52.42 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-178-52-42.ap-northeast-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.39.36.141 (Los Angeles, United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	sophos.com 2 redirects nakedsecurity.sophos.com — Cisco Umbrella Rank: 162083 www.sophos.com — Cisco Umbrella Rank: 131987	477 KB
9	company-target.com 3 redirects segments.company-target.com — Cisco Umbrella Rank: 1172 api.company-target.com — Cisco Umbrella Rank: 2928	5 KB
7	adsrvr.org 1 redirects js.adsrvr.org — Cisco Umbrella Rank: 1393 insight.adsrvr.org — Cisco Umbrella Rank: 529 match.adsrvr.org — Cisco Umbrella Rank: 325	7 KB
5	clarity.ms 1 redirects h.clarity.ms — Cisco Umbrella Rank: 1840 c.clarity.ms — Cisco Umbrella Rank: 613	24 KB
5	linkedin.com 5 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 382 www.linkedin.com — Cisco Umbrella Rank: 585 px4.ads.linkedin.com — Cisco Umbrella Rank: 4726	4 KB
4	doubleclick.net 3 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 71 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 cm.g.doubleclick.net — Cisco Umbrella Rank: 191	3 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 3554	6 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 329 c.bing.com — Cisco Umbrella Rank: 201	13 KB
3	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 19684	762 B
3	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2	817 B
3	google-analytics.com 2 redirects ssl.google-analytics.com — Cisco Umbrella Rank: 261	18 KB
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 543	453 B
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 431	1019 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	428 B
2	yahoo.com 1 redirects sp.analytics.yahoo.com — Cisco Umbrella Rank: 810 ups.analytics.yahoo.com — Cisco Umbrella Rank: 281	1 KB
2	adsymptotic.com 1 redirects p.adsymptotic.com — Cisco Umbrella Rank: 497	539 B
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 396	7 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 6742 q.quora.com — Cisco Umbrella Rank: 2774	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 131	113 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 53	82 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2415 pixel.wp.com — Cisco Umbrella Rank: 2324	3 KB
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 313	914 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 105	15 KB
1	t.co t.co — Cisco Umbrella Rank: 484	337 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 490	355 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 570	10 KB
1	demandbase.com scripts.demandbase.com — Cisco Umbrella Rank: 5764	16 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 747	3 KB
1	en25.com img03.en25.com — Cisco Umbrella Rank: 15040	3 KB
85	29

	Domain	Requested by
21	nakedsecurity.sophos.com	2 redirects nakedsecurity.sophos.com
16	www.sophos.com	nakedsecurity.sophos.com
8	segments.company-target.com	3 redirects nakedsecurity.sophos.com
4	match.adsrvr.org	js.adsrvr.org
4	tags.srv.stackadapt.com	nakedsecurity.sophos.com tags.srv.stackadapt.com
3	h.clarity.ms	bat.bing.com h.clarity.ms
3	px.ads.linkedin.com	3 redirects
3	www.google.co.jp	nakedsecurity.sophos.com
3	www.google.com	2 redirects nakedsecurity.sophos.com
3	bat.bing.com	nakedsecurity.sophos.com bat.bing.com
3	ssl.google-analytics.com	2 redirects nakedsecurity.sophos.com
2	c.clarity.ms	1 redirects
2	id.rlcdn.com	2 redirects
2	match.prod.bidr.io	2 redirects
2	www.facebook.com	nakedsecurity.sophos.com
2	p.adsymptotic.com	1 redirects nakedsecurity.sophos.com
2	stats.g.doubleclick.net	2 redirects
2	s.yimg.com	nakedsecurity.sophos.com s.yimg.com
2	js.adsrvr.org	www.googletagmanager.com match.adsrvr.org
2	connect.facebook.net	nakedsecurity.sophos.com connect.facebook.net
2	www.googletagmanager.com	nakedsecurity.sophos.com www.googletagmanager.com
1	pixel.rubiconproject.com	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	ups.analytics.yahoo.com	1 redirects
1	insight.adsrvr.org	1 redirects
1	c.bing.com	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	api.company-target.com	scripts.demandbase.com
1	www.googleadservices.com	www.googletagmanager.com
1	q.quora.com	nakedsecurity.sophos.com
1	sp.analytics.yahoo.com	nakedsecurity.sophos.com
1	t.co	nakedsecurity.sophos.com
1	analytics.twitter.com	nakedsecurity.sophos.com
1	px4.ads.linkedin.com	1 redirects
1	www.linkedin.com	1 redirects
1	a.quora.com	nakedsecurity.sophos.com
1	static.ads-twitter.com	nakedsecurity.sophos.com
1	scripts.demandbase.com	nakedsecurity.sophos.com
1	snap.licdn.com	nakedsecurity.sophos.com
1	pixel.wp.com	nakedsecurity.sophos.com
1	img03.en25.com	nakedsecurity.sophos.com
1	stats.wp.com	nakedsecurity.sophos.com
85	42

This site contains links to these domains. Also see Links.

Domain
www.sophos.com
home.sophos.com
www.facebook.com
twitter.com
www.linkedin.com
reddit.com
myonlinesecurity.co.uk
www.instagram.com
aws.amazon.com
wpvip.com

Subject Issuer	Validity	Valid
nakedsecurity.sophos.com R3	`2022-04-08` - `2022-07-07`	3 months	crt.sh
www.sophos.com GlobalSign Extended Validation CA - SHA256 - G3	`2022-01-05` - `2023-02-06`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2021-09-14` - `2022-09-14`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2022-03-16` - `2022-09-16`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-02-04` - `2022-05-05`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-18` - `2022-10-14`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
quora.com R3	`2022-04-17` - `2022-07-16`	3 months	crt.sh
*.srv.stackadapt.com Amazon	`2021-11-09` - `2022-12-07`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-04-25` - `2022-06-15`	2 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-24` - `2023-01-23`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-01-24` - `2023-01-23`	a year	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-03-15` - `2022-09-07`	6 months	crt.sh
*.quora.com R3	`2022-03-27` - `2022-06-25`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.company-target.com Amazon	`2021-08-31` - `2022-09-29`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-20` - `2022-09-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.google.co.jp GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Frame ID: 782DEF2468DEC4959181E0A3164DC80D
Requests: 77 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: CF839F28735218DD93605427704C9D9F
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0
Frame ID: E3CCBA7A6CAAACB9B85AB46F05113D55
Requests: 2 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-IjoFCg9E2uJArC3ztDqNaCji2KKr63I-~A&gdpr=0&gdpr_consent=
Frame ID: 8A376FFC0FDE957DC4CDD4CE40024E81
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&google_gid=CAESEM9kWZkKd_ysBqDqyUj1jNU&google_cver=1
Frame ID: A9498990453AAC5F0E716F69703D8966
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Frame ID: A8A99CB666D2DE241255E00359FE2646
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ランサムウェア GandCrab による攻撃の解説 – Naked Security

Page URL History Show full URLs

http://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital HTTP 301
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital HTTP 301
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Page Statistics

85
Requests

92 %
HTTPS

35 %
IPv6

29
Domains

42
Subdomains

30
IPs

8
Countries

815 kB
Transfer

2038 kB
Size

53
Cookies

49 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sophos.com/

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/free-tools.aspx
Title: Free Tools

Search URL Search Domain Scan URL

URL: https://home.sophos.com/en-us.aspx
Title: Free Sophos Home

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/next-gen-firewall.aspx
Title: XG Firewall Next-Gen Firewall

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/intercept-x.aspx
Title: Intercept X Next-Gen Endpoint

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/cloud-optix.aspx
Title: Sophos Cloud Optix

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/sophos-central.aspx
Title: Sophos Central

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/mobile-control.aspx
Title: Sophos Mobile

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/server-security.aspx
Title: Intercept X for Server

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/secure-wifi.aspx
Title: Secure Wi-Fi

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/phish-threat.aspx
Title: Phish Threat

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/safeguard-encryption.aspx
Title: SafeGuard Encryption

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/sophos-email.aspx
Title: Secure Email

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/unified-threat-management.aspx
Title: SG UTM

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/secure-web-gateway.aspx
Title: Secure Web Gateway

Search URL Search Domain Scan URL

URL: https://home.sophos.com/
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/free-tools.aspx
Title: Free Security Tools

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/free-trials.aspx
Title: Free Trials

Search URL Search Domain Scan URL

URL: https://www.sophos.com/products/demos.aspx
Title: Product Demos

Search URL Search Domain Scan URL

URL: https://www.facebook.com/share.php?u=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&title=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2+GandCrab+%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2+GandCrab+%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC+https%3A%2F%2Fnakedsecurity.sophos.com%2F%3Fp%3D439979

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&title=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2+GandCrab+%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC

Search URL Search Domain Scan URL

URL: https://reddit.com/submit/?url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&title=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2+GandCrab+%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC

Search URL Search Domain Scan URL

URL: https://www.sophos.com/ja-jp/products/endpoint-antivirus.aspx
Title: Endpoint Protection

Search URL Search Domain Scan URL

URL: https://www.sophos.com/ja-jp/products/intercept-x.aspx?cmp=26103
Title: Intercept X

Search URL Search Domain Scan URL

URL: https://myonlinesecurity.co.uk/fake-receipt-malspam-delivers-gandcrab-ransomware-via-pdf-dropping-macro-dropping-exploit-file/
Title: 最も古い情報

Search URL Search Domain Scan URL

URL: https://www.sophos.com/ja-jp/products/intercept-x.aspx
Title: CryptoGuard

Search URL Search Domain Scan URL

URL: https://www.sophos.com/ja-jp/lp/ransomware.aspx
Title: ランサムウェア対策テクノロジー

Search URL Search Domain Scan URL

URL: https://www.sophos.com/ja-jp.aspx
Title: sophos.com

Search URL Search Domain Scan URL

URL: https://twitter.com/nakedsecurity
Title: @NakedSecurity on Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/nakedsecurity/
Title: @NakedSecurity on Instagram

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/free-tools/sophos-xg-firewall-home-edition.aspx
Title: Sophos Firewall Home Edition Boost your home network security.

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx
Title: Sophos Scan & Clean Free second-opinion scanner for PCs.

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/marketplace/pp/prodview-7silxvfxce4zq?qid=1599237395672&sr=0-1&ref_=srh_res_product_title
Title: Sophos Cloud Optix Monitor 25 cloud assets for free.

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/company.aspx
Title: About Sophos

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/sophos-group-privacy-policy.aspx
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal.aspx
Title: Legal

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/intercept-x.aspx
Title: Intercept X

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/server-security.aspx
Title: Intercept X for Server

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/mobile-control.aspx
Title: Intercept X for Mobile

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/next-gen-firewall.aspx
Title: XG Firewall

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/sophos-email.aspx
Title: Sophos Email

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/secure-wifi.aspx
Title: Sophos Wireless

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/managed-threat-response.aspx
Title: Managed Threat Response

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/phish-threat.aspx
Title: Phish Threat

Search URL Search Domain Scan URL

URL: https://twitter.com/NakedSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SophosSecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/5053/

Search URL Search Domain Scan URL

URL: https://wpvip.com/?utm_source=vip_powered_wpcom&utm_medium=web&utm_campaign=VIP%20Footer%20Credit&utm_term=nakedsecurity.sophos.com
Title: WordPress VIP

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital HTTP 301
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital HTTP 301
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1640699888&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&utmhid=582932604&utmr=-&utmp=%2Fnakedsecurity%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&utmht=1651118285409&utmac=UA-737537-1&utmcc=__utma%3D1.630175758.1651118285.1651118285.1651118285.1%3B%2B__utmz%3D1.1651118285.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=989928829&utmredir=1&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888 HTTP 302
https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888&slf_rd=1&random=4199461681

Request Chain 50

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=911977272&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&utmhid=582932604&utmr=-&utmp=%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&utmht=1651118285413&utmac=UA-737537-25&utmcc=__utma%3D222203399.1907354587.1651118285.1651118285.1651118285.1%3B%2B__utmz%3D222203399.1651118285.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1487231638&utmredir=1&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272 HTTP 302
https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272&slf_rd=1&random=2492122655

Request Chain 52

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1651118285424%26url%3Dhttps%253A%252F%252Fnakedsecurity.sophos.com%252Fja%252F2019%252F02%252F14%252Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&cookiesTest=true&liSync=true&e_ipv6=AQKauoBt7qAPkAAAAYBuUaQSLQaknvo3Eax3mVZuflNcJtFlBNsbLPJtfk-IAtASpYsuSQ HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=e4577f35-c34d-419c-ad3f-9234f31fd2bb HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=e4577f35-c34d-419c-ad3f-9234f31fd2bb&_expected_cookie=3795bad5acabb021b925118322c2d7ab

Request Chain 64

https://segments.company-target.com/l/dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc= HTTP 303
https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=7cdb852a4f27746567720bd43a965d467849527a

Request Chain 65

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AADRNk7E1CIAADs-JHG6vg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AADRNk7E1CIAADs-JHG6vg&verifyHash=251347c79a64b603c3f1fdf320a810942077da0f

Request Chain 66

https://id.rlcdn.com/464526.gif HTTP 307
https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCM2hqJMGEgUI6AcQAEIASgA HTTP 307
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297h64Iej_mvrx-QMZqmD2blS3vrC_EsRLBkqokxD2SYLU HTTP 303
https://segments.company-target.com/validateCookie?vendor=liveramp&user_id=Xc1297h64Iej_mvrx-QMZqmD2blS3vrC_EsRLBkqokxD2SYLU&verifyHash=776dd1f79dd4737b5a87e3700f1b86eea6ce316

Request Chain 75

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=6D291DF209DA4A17B4CE91A355433683&RedC=c.clarity.ms&MXFR=173EBAD054F968263358AB4450F966DD HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6D291DF209DA4A17B4CE91A355433683&MUID=2DD1BD68EDBF61930102ACFCEC4D60C8

Request Chain 76

https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0 HTTP 302
https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0

Request Chain 78

https://ups.analytics.yahoo.com/ups/55953/sync?uid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&_origin=1&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-IjoFCg9E2uJArC3ztDqNaCji2KKr63I-~A&gdpr=0&gdpr_consent=

Request Chain 79

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NWE3ZDdiNDAtM2U1YS00YjIxLWE4YTMtNTA3NmM4ZTU3Nzcz&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&google_gid=CAESEM9kWZkKd_ysBqDqyUj1jNU&google_cver=1

Request Chain 80

https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

85 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Redirect Chain

http://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital
https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

76 KB
23 KB

3ms
3ms

Document
text/html

2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx / WordPress VIP <https://wpvip.com>

Resource Hash

afd332f0a541472efd7be7b6e231b5b2df9a3412dcaced67bc66808db493fea5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
age: 41
cache-control: max-age=300, must-revalidate
content-encoding: gzip
content-length: 23381
content-type: text/html; charset=UTF-8
date: Thu, 28 Apr 2022 03:58:05 GMT
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://nakedsecurity.sophos.com/wp-json/>; rel="https://api.w.org/" <https://nakedsecurity.sophos.com/?p=439979>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cache: hit
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-rq: nrt2 0 2 9980

Redirect headers

age: 41
cache-control: max-age=300, must-revalidate
content-encoding: gzip
content-length: 20
content-type: text/html; charset=UTF-8
date: Thu, 28 Apr 2022 03:58:05 GMT
host-header: a9130478a60e5f9135f765b23f26593b
location: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
server: nginx
strict-transport-security: max-age=31536000
x-cache: hit
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-redirect-by: WordPress
x-rq: nrt2 0 2 9980

GET
H2 200 /
nakedsecurity.sophos.com/_static/ 96 KB
14 KB 2ms
2ms Stylesheet
text/css 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJyNy0EOQDAQheELqVFCYiHOUu1EhmlJpyK9PRsJO8s/731w7oqC5cOhgBUBR5Jg4s2uimmKJmaQlBlLT6G8DwW8xSLg0ZFBRo8hfWJnkzEqxtnY/I/f27sfNPpBd23V60bX9QWHdUGf

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

061473d06c676e692148c9e53870122e472f133abc759c56e871a162e79b9376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Mon, 25 Apr 2022 18:58:42 GMT
server: nginx
age: 202088
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 14166

GET
H2 200 /
nakedsecurity.sophos.com/_static/ 191 KB
35 KB 3ms
2ms Stylesheet
text/css 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5e153ac5bbf2518558464952c22a5bc20b349fa2e2921f853e3d1f75645348b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Wed, 27 Apr 2022 21:34:10 GMT
server: nginx
age: 22297
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 36016

GET
H2 200 / Show response
nakedsecurity.sophos.com/_static/ 98 KB
34 KB 5ms
5ms Script
application/javascript 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZqYGlobGhkVEWAK9PIhY=

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Mon, 25 Apr 2022 18:58:42 GMT
server: nginx
age: 202828
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 34312

GET
H2 200 naked-security-logo-white@2x.png
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 2 KB
2 KB 2ms
2ms Image
image/png 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/naked-security-logo-white@2x.png

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

6280af26ccd34631a90de8cc4f33e915d39720dd7767ea8a2042e1864dd0819a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Sat, 05 Mar 2022 06:21:29 GMT
server: nginx
age: 3216570
etag: W/"62230169-90b"
strict-transport-security: max-age=31536000
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 2338
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 2F4785DE8C3F43ECBD699A18F332FEEB.ashx
www.sophos.com/medialibrary/ 13 KB
13 KB 73ms
9ms Image
image/png 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/2F4785DE8C3F43ECBD699A18F332FEEB.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

4c331a19f481eb536fa4ddc75c1c8808057f1357bcf8c61e6ab963b6dc2a6907

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:19 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: private, max-age=1822
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-ua-compatible: IE=edge
content-length: 13036
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:27 GMT

GET
H2 200 27111765D65A45D49A232925D2CE428B.ashx
www.sophos.com/medialibrary/ 22 KB
22 KB 82ms
18ms Image
image/png 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/27111765D65A45D49A232925D2CE428B.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

63ee1658cac1b7a77753a1bf9e9fc5e7a05e73426e608fef3f2b482a1f0c71ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 13:25:09 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: private, max-age=1769
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-ua-compatible: IE=edge
content-length: 22556
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:27:34 GMT

GET
H2 200 sophos-cloud-optix-icon.svg
www.sophos.com/medialibrary/SophosNext/Images/Products/Icons/ 2 KB
2 KB 92ms
29ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/SophosNext/Images/Products/Icons/sophos-cloud-optix-icon.svg

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

6ddecf084e5b6ed52ab9c8143890a72a3d695edee6fafbf4ca5128a7cd6f1b3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 186
strict-transport-security: max-age=10886400
content-encoding: gzip
x-content-type-options: nosniff
x-edgeconnect-midmile-rtt: 135
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 1110
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 10 Dec 2021 07:20:59 GMT
x-frame-options: SAMEORIGIN
date: Thu, 28 Apr 2022 03:58:05 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private, max-age=153
expires: Thu, 28 Apr 2022 04:00:38 GMT

GET
H2 200 08EA66123F1B4DDE8FE5C9B578A7FAA7.ashx
www.sophos.com/medialibrary/ 2 KB
2 KB 103ms
39ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/08EA66123F1B4DDE8FE5C9B578A7FAA7.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

bf45a939fd9e6d74a7acc1b575d73088396888717272bb8643c2b5479afea4a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 20 Oct 2021 05:49:44 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1796
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 1252
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:01 GMT

GET
H2 200 678FE994855047739F50D6C411184FA6.ashx
www.sophos.com/medialibrary/ 1 KB
1 KB 113ms
50ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/678FE994855047739F50D6C411184FA6.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

86f388a06affc92020302d848bc31e5df0593256b24bfe1c1a9d8d3d8e70915a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:44:40 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1848
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 786
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:53 GMT

GET
H2 200 01B80E7D7CD54EF8AC2E51C9C6EC0236.ashx
www.sophos.com/medialibrary/ 2 KB
1 KB 124ms
61ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/01B80E7D7CD54EF8AC2E51C9C6EC0236.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

1621e7c862be84cd5d2cd8e4b3a4d8382b853714d6ca0a57da9a04b115a42364

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:43:01 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1847
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 891
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:52 GMT

GET
H2 200 BEBD9C41BB4E480498514B29B92A145A.ashx
www.sophos.com/medialibrary/ 942 B
892 B 61ms
60ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/BEBD9C41BB4E480498514B29B92A145A.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

e062f5843f223fb2222333e6cca83f64b1d307875aeca187aec1a3055f3157b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:48:32 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1791
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 535
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:27:56 GMT

GET
H2 200 DC9D1A7BA3964B0C9DAF1F1E68806B5A.ashx
www.sophos.com/medialibrary/ 1 KB
1 KB 69ms
69ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/DC9D1A7BA3964B0C9DAF1F1E68806B5A.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

1b15df54cdbcf927d9ca83dec5a5804283f3a3aae0d1a787897b516690ff5d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 13:00:46 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1847
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 691
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:52 GMT

GET
H2 200 8F51F06B62814B108D3B2763FF018E37.ashx
www.sophos.com/medialibrary/ 2 KB
1 KB 78ms
77ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/8F51F06B62814B108D3B2763FF018E37.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

161e1d347ed141e560fdff4e56964d7fa41834bdbc779b2c59722ac15e50f0cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 13:02:43 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4385
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 932
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 05:11:10 GMT

GET
H2 200 597ADA0AF01A4A12B2B27239D0F9992C.ashx
www.sophos.com/medialibrary/ 1 KB
1 KB 86ms
85ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/597ADA0AF01A4A12B2B27239D0F9992C.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

4503e524f77aba44b36b834f2f8efc08a48189f7915ed42956b151c9afb55c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:53:02 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1822
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 756
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:27 GMT

GET
H2 200 8CB72BF5E1AD41F7894CE5E42101B0F3.ashx
www.sophos.com/medialibrary/ 975 B
804 B 93ms
92ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/8CB72BF5E1AD41F7894CE5E42101B0F3.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

e1b293d96560e1b12aafc0b0798ead6291de4c789c78671fff5609cea24aeedc

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 08 Mar 2018 07:45:50 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1811
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 448
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:16 GMT

GET
H2 200 C586E372694547A1B207A61D87246BA7.ashx
www.sophos.com/medialibrary/ 2 KB
1 KB 100ms
99ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/C586E372694547A1B207A61D87246BA7.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

edfc15c6d8e105511ebc6f81ca49ec279a1f608c5b9e465cf37a56baba09750b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 20 Aug 2021 12:58:49 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=4354
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 1078
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 05:10:39 GMT

GET
H2 200 3376DF5742A64AEE93FDB9DCA7291239.ashx
www.sophos.com/medialibrary/ 3 KB
4 KB 108ms
107ms Image
image/png 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/3376DF5742A64AEE93FDB9DCA7291239.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

e8eab802d8a017af747aeb8abd3c937420e3f0a2c0f3d06828df322e620c6867

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:18 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: private, max-age=4185
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
x-ua-compatible: IE=edge
content-length: 3295
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 05:07:50 GMT

GET
H2 200 A1FF440D2BB84511B8C94D771D44E207.ashx
www.sophos.com/medialibrary/ 318 B
601 B 116ms
115ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/A1FF440D2BB84511B8C94D771D44E207.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

b2fe29d1813dd78bc44fcb57c65740ee5965fe6985c5c69d9576e0c0a9b5fe5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:18 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1813
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 244
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:28:18 GMT

GET
H2 200 FCD3410ED2C347808D9DB8AC12C62DBD.ashx
www.sophos.com/medialibrary/ 391 B
627 B 122ms
122ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/FCD3410ED2C347808D9DB8AC12C62DBD.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

1a49a2cffa6dda5993f1571558d44644ad9517dfa370fbb7b0e9d005d33fc7bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:18 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1740
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 271
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:27:05 GMT

GET
H2 200 50985180E5F54C94917A2A6508E24287.ashx
www.sophos.com/medialibrary/ 441 B
666 B 145ms
144ms Image
image/svg+xml 23.36.105.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sophos.com/medialibrary/50985180E5F54C94917A2A6508E24287.ashx

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.105.121 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-105-121.deploy.static.akamaitechnologies.com

Software

Resource Hash

e4aadbfb76725939385602738ef216b5f75ee5a3d3824d82be9862c43bb1b079

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 15 Oct 2018 05:53:17 GMT
date: Thu, 28 Apr 2022 03:58:05 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-ua-compatible: IE=edge
cache-control: private, max-age=1717
x-content-type-options: nosniff
server-timing: cdn-cache; desc=HIT, edge; dur=1
vary: Accept-Encoding
content-length: 309
x-xss-protection: 1; mode=block
expires: Thu, 28 Apr 2022 04:26:42 GMT

GET
H2 200 shutterstock_1180079992-compressor.jpg
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2019/02/ 46 KB
46 KB 3ms
2ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2019/02/shutterstock_1180079992-compressor.jpg?resize=780,408

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7dab67b04713996fdffb35641b4f7193b794a38dae237c0128edb7bf368f4966

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 113 117 443
last-modified: Mon, 25 Apr 2022 01:40:31 GMT
server: nginx
etag: "8382a94a0bbf9736"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 46982
expires: Tue, 25 Apr 2023 01:40:31 GMT

GET
H2 200 / Show response
nakedsecurity.sophos.com/_static/ 300 KB
75 KB 3ms
3ms Script
application/javascript 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/_static/??-eJyNy0EKgCAQQNELZaNGQYvoMDaU4oziGNHtk6B928/7cGXlElfkCvVAQgFJ+UjCeImy2owQBHI8d8/SB+ng1+BSwU97dvHcmns7UTtVwRzvnjw3tNJiplHPZjDWhgceIzNf

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

14662aba6fd932277ae74140fc4e0c46fa8b3bf3999919454036be05851055d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Mon, 25 Apr 2022 18:58:42 GMT
server: nginx
age: 202828
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 76345

GET
H2 200 e-202217.js Show response
stats.wp.com/ 9 KB
3 KB 9ms
1ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202217.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-nc: HIT nrt
date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: br
server: nginx
etag: W/"61b11a4d-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 17 Apr 2023 03:45:13 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 105 KB
40 KB 155ms
45ms Script
application/javascript 2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VK6LTK

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3acf98b85a977f8028e3aacb5fdc77649de1578754e5b08492361c7a72efc535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40876
x-xss-protection: 0
last-modified: Thu, 28 Apr 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 28 Apr 2022 03:58:05 GMT

GET
H2 200 icon-search-99cae8.svg
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 2 KB
978 B 2ms
1ms Image
image/svg+xml 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/icon-search-99cae8.svg

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f09c53ca35858cba3d65ebcc619e4ff5d68ab5590391d3f0bb0fdca57a89d816

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
x-rq: nrt2 0 2 9980
last-modified: Mon, 28 Mar 2022 22:00:12 GMT
server: nginx
age: 41
etag: W/"62422fec-7b0"
vary: X-Mobile-Class
x-cache: hit
content-type: image/svg+xml
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 879
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 klinicslabbook-webfont.woff2
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 2ms
2ms Font
font/woff2 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/klinicslabbook-webfont.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f05a815262962493146cae3d7370bfa4c5d488fc8630e5caf861f33f2ede341d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
Origin: https://nakedsecurity.sophos.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 26
x-cache: hit
content-length: 26372
x-rq: nrt2 0 2 9980
last-modified: Mon, 28 Mar 2022 22:00:12 GMT
server: nginx
etag: W/"62422fec-66e8"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 flama-medium-webfont.woff
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 3ms
3ms Font
font/woff 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/flama-medium-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b0a63a118c83ee872479df62851952db56d1d01f6dad0b148b3522b7b712d47d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
Origin: https://nakedsecurity.sophos.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 26
x-cache: hit
content-length: 26450
x-rq: nrt2 0 2 9980
last-modified: Mon, 28 Mar 2022 22:00:12 GMT
server: nginx
etag: W/"62422fec-676c"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 flama-light-webfont.woff
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 2ms
2ms Font
font/woff 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/flama-light-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f02048fc30cf09f21fabfee36fb76feb7c239a3b6b0a011e6c5ab4c91422fd0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
Origin: https://nakedsecurity.sophos.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 26
x-cache: hit
content-length: 26215
x-rq: nrt2 0 2 9980
last-modified: Mon, 28 Mar 2022 22:00:12 GMT
server: nginx
etag: W/"62422fec-6684"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 post-nav-previous.png
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 365 B
414 B 3ms
3ms Image
image/png 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/post-nav-previous.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d85e8f32872c1fd6438f8a355f4b7226b5af9ba87474e590cc352f6cd16d2d9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Sat, 05 Mar 2022 06:21:29 GMT
server: nginx
age: 3215536
etag: "62230169-16d"
strict-transport-security: max-age=31536000
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 365
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 post-nav-next.png
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/ 364 B
418 B 2ms
2ms Image
image/png 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/img/post-nav-next.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

707d0980b1c65b912c943b578c3a576a01ed96cab83b0e6b8bd6602b9835066c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 0 2 9980
last-modified: Sat, 05 Mar 2022 06:21:29 GMT
server: nginx
age: 3215536
etag: "62230169-16c"
strict-transport-security: max-age=31536000
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 364
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 chrome-1200.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/04/ 7 KB
7 KB 2ms
1ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/04/chrome-1200.png?w=412&h=200&crop=1

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

40a36fd024a865b9e3e97ad53606eeece383ce012bd8d63aa2dfc854c7d04e9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 118 20 443
last-modified: Sat, 16 Apr 2022 04:00:15 GMT
server: nginx
etag: "75f62aa5395ae79b"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 7112
expires: Sun, 16 Apr 2023 04:00:15 GMT

GET
H2 200 ns-1200-logo-podcast-with-mic-1.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2021/09/ 15 KB
15 KB 3ms
2ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2021/09/ns-1200-logo-podcast-with-mic-1.png?w=412&h=200&crop=1

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8ddfbc2df97c0bef954c871b7bed49d48473c52b6a6d20677503863c0b546efb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 113 117 443
last-modified: Fri, 24 Sep 2021 17:43:25 GMT
server: nginx
etag: "40ca84909b4da6aa"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 15188
expires: Sat, 24 Sep 2022 17:43:25 GMT

GET
H2 200 cat-1200.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/04/ 36 KB
36 KB 3ms
2ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2022/04/cat-1200.png?w=412&h=200&crop=1

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4ee90bd9f521aa1bcea667322a0fd33bf3a3ba12e5ca0e2d088bda560a9eef19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 118 85 443
last-modified: Mon, 11 Apr 2022 20:36:48 GMT
server: nginx
etag: "e1b68b2937d26683"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 36700
expires: Tue, 11 Apr 2023 20:36:48 GMT

GET
H2 200 klinicslablight-webfont.woff2
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 25 KB
26 KB 4ms
3ms Font
font/woff2 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/klinicslablight-webfont.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f06210c8e0ec5ba4f4679ba1c9a301176def4a552f29388629ddaef7320681ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
Origin: https://nakedsecurity.sophos.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 26
x-cache: hit
content-length: 26016
x-rq: nrt2 0 2 9980
last-modified: Mon, 28 Mar 2022 22:00:12 GMT
server: nginx
etag: W/"62422fec-6584"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 flama-book-webfont.woff
nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/ 26 KB
26 KB 4ms
4ms Font
font/woff 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://nakedsecurity.sophos.com/wp-content/themes/sophosnews-2015/fonts/flama-book-webfont.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

964dd54dd651e6c51d925cd29df29d85678781f357444e148522b04bb0a28bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nakedsecurity.sophos.com/_static/??-eJyNzEsOwjAMRdEN4TipFAQDxFqsYBEgH6t2VHX3FMSMSadP5z5cBFJvxs3QMldW1C65a+NFYfIhotpa2CXVA+7EUMhYbW+zMaSbszwzGeSx4dlRlb++DpAy7o+m+GQTSi8I3p2+B7/h01zrJRxj8Oc4Rf8GdfFQcw==
Origin: https://nakedsecurity.sophos.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 26
x-cache: hit
content-length: 26315
x-rq: nrt2 0 2 9980
last-modified: Mon, 28 Mar 2022 22:00:12 GMT
server: nginx
etag: W/"62422fec-66e4"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 28 Apr 2023 03:58:05 GMT

GET
H2 200 gandcrab-attack-first-wave-1.png
nakedsecurity.sophos.com/wp-content/uploads/sites/2/2019/02/ 5 KB
5 KB 2ms
2ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2019/02/gandcrab-attack-first-wave-1.png

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

86d72c164d9cec2913a0c7fd7b5f994ab5436b819fc68c68f5892efaf8db4778

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
x-rq: nrt2 113 149 443
last-modified: Mon, 25 Apr 2022 01:41:33 GMT
server: nginx
etag: "5dd1becd67970288"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 5254
expires: Tue, 25 Apr 2023 01:41:33 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 79ms
2ms Script
text/javascript 2404:6800:4004:822::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/_static/??-eJyNy0EKgCAQQNELZaNGQYvoMDaU4oziGNHtk6B928/7cGXlElfkCvVAQgFJ+UjCeImy2owQBHI8d8/SB+ng1+BSwU97dvHcmns7UTtVwRzvnjw3tNJiplHPZjDWhgceIzNf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:822::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 620
date: Thu, 28 Apr 2022 03:47:45 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Thu, 28 Apr 2022 05:47:45 GMT

GET
H/1.1 200
OK elqCfg.min.js Show response
img03.en25.com/i/ 6 KB
3 KB 19ms
9ms Script
application/x-javascript 184.26.249.60
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://img03.en25.com/i/elqCfg.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

184.26.249.60 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-26-249-60.deploy.static.akamaitechnologies.com

Software

Resource Hash

3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
X-Content-Type-Options: nosniff
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection: keep-alive
Content-Length: 2183
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Fri, 14 Jan 2022 15:05:19 GMT
Date: Thu, 28 Apr 2022 03:58:05 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: no-store
ETag: "3cc21925589d81:0"
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Expires: Thu, 28 Apr 2022 03:58:05 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 3ms
1ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.8&blog=166161173&post=439979&tz=1&srv=nakedsecurity.sophos.com&hp=vip&host=nakedsecurity.sophos.com&ref=&fcp=145&rand=0.9896628139447721
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 28 Apr 2022 03:58:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 46ms
35ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 23:54:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CAD18FE7917E4F6097ADFD7A60AAFA4E Ref B: TYBEDGE0520 Ref C: 2022-04-28T03:58:05Z
etag: "806a236c101ed81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
date: Thu, 28 Apr 2022 03:58:04 GMT
accept-ranges: bytes
content-length: 11347

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 14ms
3ms Script
application/x-javascript 2a03:2880:f00f:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26311
x-xss-protection: 0
pragma: public
x-fb-debug: qUVvHeCF3Vf06hqZxA8UR8Cg6dKlhHKnlxh4aWWpBJdERTwEKjp85q1s7T1gCV+gQzw937inutcRtjDk6O0DkA==
x-fb-trip-id: 382461245
x-frame-options: DENY
date: Thu, 28 Apr 2022 03:58:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 20ms
4ms Script
application/x-javascript 2600:140b:2::174d:ccb0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:140b:2::174d:ccb0 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 28 Apr 2022 03:58:05 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
X-EdgeConnect-Cache-Status: 1
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=26988
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 105 KB
41 KB 41ms
41ms Script
application/javascript 2404:6800:4004:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-743773256

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VK6LTK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:81f::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

350448de4029a22317c409036bcc063e6ad7f8a80b269f71da6eed7563c3b30f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42191
x-xss-protection: 0
last-modified: Thu, 28 Apr 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 28 Apr 2022 03:58:05 GMT

GET
H2 200 WuEFNglz.min.js Show response
scripts.demandbase.com/ 61 KB
16 KB 91ms
10ms Script
application/javascript 143.204.73.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://scripts.demandbase.com/WuEFNglz.min.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.73.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-73-109.nrt12.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: LCueR8U3D7lJgwCfemj1Slg2LluSXKrc
content-encoding: gzip
etag: W/"b068f44152e87ccb66f40491a735aad0"
age: 20
x-cache: Hit from cloudfront
vary: Accept-Encoding
last-modified: Thu, 17 Jun 2021 19:46:43 GMT
server: AmazonS3
date: Thu, 28 Apr 2022 03:58:05 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 876cb7e4a24cc65c5d4fe1273662a7b0.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: NRT12-C2
x-amz-cf-id: fbj4jcAqlgQQQphhd7glymjWuw3Bosv1P2w2S0EHhzJvAtGD4Eb-RA==

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 28 KB
10 KB 11ms
2ms Script
application/javascript 151.101.108.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.108.157 Tokyo, Japan, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 70d4c4423dab9cf00b6e9bcf57518eeafff00e9d2499f4463498b03bef2bdc33

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
last-modified: Thu, 21 Apr 2022 19:15:15 GMT
etag: "c47a9d4becaab89e22af7ba863c58452+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 9501
x-served-by: cache-iad-kiad7000059-IAD, cache-tyo11962-TYO

GET
H2 200 qevents.js Show response
a.quora.com/ 40 KB
14 KB 24ms
3ms Script
text/plain 151.101.193.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: vyBstMTGyA6m5sV66zq8xsypUg.tAOk.
content-encoding: gzip
etag: "47078e63380c6b0cbbfb6d8508b25ee7"
age: 6028
x-cache: HIT, HIT
content-length: 14031
x-amz-id-2: Mt5ixruyZQMuz2hyMbp/KTbIH5giRHNsfo1OkmpT5XkJbFR2kZYpxLrrBKhfsMq5S8uY+UYjOac=
x-served-by: cache-iad-kcgs7200167-IAD, cache-hnd18720-HND
last-modified: Fri, 18 Mar 2022 00:16:52 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1647562609/ctime:1647562609/gid:150037/gname:ezhang/md5:47078e63380c6b0cbbfb6d8508b25ee7/mode:33204/mtime:1647562609/uid:150037/uname:ezhang
x-timer: S1651118285.413576,VS0,VE0
date: Thu, 28 Apr 2022 03:58:05 GMT
vary: Accept-Encoding
x-amz-request-id: TA3D3A2BNPW868DS
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=7200
accept-ranges: bytes
content-type: text/plain
x-cache-hits: 1, 186

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 14 KB
5 KB 698ms
173ms Script
text/javascript 34.193.254.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.254.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-254-175.compute-1.amazonaws.com
Software: /
Resource Hash: 759c08870ec11ea02ee31178d93da8b3613e8c8433c2954f07c7f5edb3be8a91

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 28 Apr 2022 03:58:06 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4424
Connection: keep-alive
Content-Type: text/javascript

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 24ms
3ms Script
application/x-javascript 13.225.163.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VK6LTK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.163.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-163-123.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Wed, 27 Apr 2022 18:40:24 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 33462
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 e77892dd431d44863ad00701fe285932.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: NRT12-C4
X-Amz-Cf-Id: rtmnKruAewWMdgWYqC4TCV2Nnw3998ogTY6-aXPKgv1XS_QC3s1bcw==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 13ms
2ms Script
application/javascript 2406:2000:a4:9fe::
YAHOO-SG internet...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2000:a4:9fe:: , Taiwan, ASN10230 (YAHOO-SG internet content provider, SG),

Reverse DNS

Software

ATS /

Resource Hash

10354e9bc6b485028971a1f58fccff5c89d722db324d42bc07963aab24ebb956

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Thu, 28 Apr 2022 03:50:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 443
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5748
x-amz-id-2: 9v/yLOR/bzsC2uQiq+FL7PL1QcyO0+ItOekPDHOCm1pgMF39DOpeHou6aV2zAszDoVSf+Kuxo6o=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 22 Feb 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 17 Jan 2022 12:00:39 GMT
server: ATS
etag: "13a189bb8f25228852b3279db3659c28-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 28C6XFXVZE8YX0Y5
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: pAIvW1wzOXi43b8v53GVflu.j8ZqoXS3
accept-ranges: bytes
content-type: application/javascript

GET
H2

200

ga-audiences
www.google.co.jp/ads/
Redirect Chain

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1640699888&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x120...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888
https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888&slf_rd=1&random=4199461681

42 B
501 B

123ms
40ms

Image
image/gif

2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888&slf_rd=1&random=4199461681

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=630175758.1651118285&jid=989928829&_v=5.7.2&z=1640699888&slf_rd=1&random=4199461681
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.co.jp/ads/
Redirect Chain

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=911977272&utmhn=nakedsecurity.sophos.com&utme=8(4!CampaignID)9(4!70130000001xGqlAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272
https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272&slf_rd=1&random=2492122655

42 B
107 B

125ms
43ms

Image
image/gif

2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272&slf_rd=1&random=2492122655

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-25&cid=1907354587.1651118285&jid=1487231638&_v=5.7.2&z=911977272&slf_rd=1&random=2492122655
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10150886.json Show response
s.yimg.com/wi/config/ 46 B
682 B 7ms
3ms XHR
application/octet-stream 2406:2000:a4:9fe::
YAHOO-SG internet...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10150886.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2000:a4:9fe:: , Taiwan, ASN10230 (YAHOO-SG internet content provider, SG),

Reverse DNS

Software

ATS /

Resource Hash

b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:55:09 GMT
x-content-type-options: nosniff
age: 177
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 3M844M4MJJ8EW3BC
x-amz-id-2: QXUMFgtaR3oUHXKOB/nJnehlpof0DK1uKTeIyxbQsZ0R2Bg/0KY72e2uTepSy5PJLFTt+i7RZ0Q=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 20 Jan 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 15 Dec 2021 05:54:05 GMT
server: ATS
etag: "3769bd8c10be070cf8c85c08517a8fdc"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: VO4i6Xctkzo3gjHc0HLprUqd6v7sNIpd
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/octet-stream

GET
H2

200

/
p.adsymptotic.com/d/px/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hos...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hos...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1651118285424%26url%3Dhttps%253A%252F%252Fnakedsecurity.sophos.co...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hos...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1651118285424&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-ho...
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=e4577f35-c34d-419c-ad3f-9234f31fd2bb
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=e4577f35-c34d-419c-ad3f-9234f31fd2bb&_expected_cookie=3795bad5acabb021b9251183...

43 B
142 B

99ms
98ms

Image
image/gif

104.18.101.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=e4577f35-c34d-419c-ad3f-9234f31fd2bb&_expected_cookie=3795bad5acabb021b925118322c2d7ab
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: H2
Server: 104.18.101.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:06 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 702ce0a9de9c1fcf-NRT
p3p: CP='NON DSP COR CONi OUR BUS CNT'
content-type: image/gif
content-length: 43

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=e4577f35-c34d-419c-ad3f-9234f31fd2bb&_expected_cookie=3795bad5acabb021b925118322c2d7ab
date: Thu, 28 Apr 2022 03:58:06 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 702ce0a7ac9f1fcf-NRT
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

GET
H3 200 334990480506518 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 10ms
4ms Script
application/x-javascript 2a03:2880:f00f:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/334990480506518?v=2.9.57&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b9c50509faf1e3869ddc7635ee438f1cb0f80c2dab1983ee2c24376145c2bf5b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 88872
x-xss-protection: 0
pragma: public
x-fb-debug: GXvlPEcjDolkGC22o8FZhi0ESMiE142XLC9HpnzRJbIf4QQC765cOCbIorm+Z2pBTmTqc/t8w7wP0YhSDKr+3Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 28 Apr 2022 03:58:05 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
355 B 399ms
193ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.2&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=73aab2f0-7cb7-4364-9abc-c4c3d5a94b28&tw_document_href=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-response-time: 95
date: Thu, 28 Apr 2022 03:58:05 GMT
server: tsa_m
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 58d30bce0a08f52875a1456753dafaf284b20d94baf71348efe8db4e5e69e46e
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
337 B 413ms
211ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.3.2&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=73aab2f0-7cb7-4364-9abc-c4c3d5a94b28&tw_document_href=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-response-time: 112
date: Thu, 28 Apr 2022 03:58:05 GMT
server: tsa_m
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: e93c97938892a7448226f2698e8d3b5f3d9be18b2cd1c8055ae2ab1e8d212448
content-length: 43

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
633 B 220ms
72ms Image
image/gif 106.10.236.146
YAHOO-SG3 interne...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2028%20Apr%202022%2003%3A58%3A05%20GMT&n=0&b=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&.yp=10150886&f=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&enc=UTF-8&yv=1.12.0&tagmgr=gtm

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

106.10.236.146 Singapore, Singapore, ASN56173 (YAHOO-SG3 internet content provider, SG),

Reverse DNS

spdc.pbp.vip.sg3.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Thu, 28 Apr 2022 03:58:05 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/ 43 B
422 B 687ms
171ms Image
image/gif 54.204.196.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&tag=ViewContent&ts=1651118285437

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.196.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-196-80.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 28 Apr 2022 03:58:06 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Q-Stat: ,0a9a358666269c64f2174d1ab186cb47,10.0.0.26,10588,217.138.252.53,,162420364619,1,1651118286.040,0.001,,.,0,0,0.000,0.004,-,0,0,197,168,84,10,26847,,,,,,-,
Content-Type: image/gif

GET
H2 200 4015302.js Show response
bat.bing.com/p/action/ 843 B
840 B 386ms
385ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4015302.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

cb1d2a9330cdf370943a7c6ed01b6d93e54575b4cc7b8abb665e2ef7ddf079ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 91B3AF9B4A0348D0942EC319107B8300 Ref B: TYBEDGE0520 Ref C: 2022-04-28T03:58:05Z
date: Thu, 28 Apr 2022 03:58:05 GMT
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 665

GET
H2 204 0
bat.bing.com/action/ 0
175 B 34ms
34ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=39476503-2aad-49ab-b365-0c290f0d72d7&sid=685d6c40c6a711ec84070bab2a4d5781&vid=685db1d0c6a711eca7d447ee84860c77&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&p=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&r=&lt=238&evt=pageLoad&msclkid=N&sv=1&rn=943370

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 254B370FA15A484480D66FFD7051D1B2 Ref B: TYBEDGE0520 Ref C: 2022-04-28T03:58:05Z
date: Thu, 28 Apr 2022 03:58:04 GMT
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 158ms
82ms Script
text/javascript 172.217.161.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.161.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s09-in-f2.1e100.net

Software

cafe /

Resource Hash

4902dcbc3d3c97271a66bc136ec40b0c72422ccd05bb9946aa76382e50c5d6fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14897
x-xss-protection: 0
server: cafe
etag: 9926226332162747720
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 28 Apr 2022 03:58:05 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
410 B 25ms
3ms Image
image/gif 2a03:2880:f10f:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&rl=&if=false&ts=1651118285468&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1651118285467.1384213760&it=1651118285429&coo=false&rqm=GET

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 28 Apr 2022 03:58:05 GMT

OPTIONS
H/1.1 200
OK dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc=
segments.company-target.com/l/ Frame 0
0 212ms
163ms Preflight 65.9.42.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segments.company-target.com/l/dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.42.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-42-87.nrt12.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://nakedsecurity.sophos.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Max-Age: 3600
Connection: keep-alive
Content-Length: 0
Date: Thu, 28 Apr 2022 03:58:05 GMT
Vary: Origin
Via: 1.1 55c659e0e2fe3ace02c4b6599c432138.cloudfront.net (CloudFront)
X-Amz-Cf-Id: RwZhARyTbtroQ1mGe-bb9mJj4_a4CRPcxhbhZco0drcTrL4zXNWAIQ==
X-Amz-Cf-Pop: NRT12-C5
X-Cache: Miss from cloudfront
trace-id: f032bc2ea4674322

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 428 B
944 B 134ms
117ms XHR
application/json 143.204.73.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&page_title=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/WuEFNglz.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.73.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-73-11.nrt12.r.cloudfront.net
Software: nginx /
Resource Hash: 4c1c083090007e0e9bd466628c5b82c4e0ac29f501b7049bd0744b2160fb49bf

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:05 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: NRT12-C2
x-cache: Miss from cloudfront
request-id: 3fe477b7-6ca2-4f84-95aa-4dd972719636
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://nakedsecurity.sophos.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 04908450947e316cb853500a1a3f284c.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: YuwNnc_X-5P_TGVDcEn5GZTglrXVVwTfZxJD59nX6mxB8SY_1cGr5Q==
expires: Wed, 27 Apr 2022 03:58:05 GMT

GET
H/1.1

204
No Content

validateCookie Show response
segments.company-target.com/
Redirect Chain

https://segments.company-target.com/l/dmVuZG9yPW1hcmlwb3NhJnAxPWV4YW1wbGUuY29tJnRva2VuPWYyNTE0ZTIyMjNmMjcxZGUzMDBiMTkwOGMyYzkwYzkxMWJlZDc4ZDc=
https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=7cdb852a4f27746567720bd43a965d467849527a

0
430 B

162ms
162ms

XHR
text/plain

65.9.42.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=7cdb852a4f27746567720bd43a965d467849527a
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: HTTP/1.1
Server: 65.9.42.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-42-87.nrt12.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 28 Apr 2022 03:58:06 GMT
Via: 1.1 e461cfe48b147c7ebb96d61448fb1152.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT12-C5
Vary: Origin
X-Cache: Miss from cloudfront
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
trace-id: 96d49d497b5b5c1b
X-Amz-Cf-Id: 7a_iKn5p_iPmbeKXG-1aMdDwaUn8VTGbv1rENKIEMCOhhEpj9KB2eA==

Redirect headers

Date: Thu, 28 Apr 2022 03:58:05 GMT
Via: 1.1 e461cfe48b147c7ebb96d61448fb1152.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT12-C5
Location: /validateCookie?vendor=mariposa&user_id=example.com&verifyHash=7cdb852a4f27746567720bd43a965d467849527a
Vary: Origin
X-Cache: Miss from cloudfront
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
trace-id: 43a166756fc98c05
Content-Length: 0
X-Amz-Cf-Id: ob5-I_vRsn5zYFMRK6W--JZLNBlp9RAY13_3r0TPC9m9sZ33eOWYfw==

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AADRNk7E1CIAADs-JHG6vg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AADRNk7E1CIAADs-JHG6vg&verifyHash=251347c79a64b603c3f1fdf320a810942077da0f

26 B
409 B

322ms
321ms

Image
image/gif

65.9.42.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AADRNk7E1CIAADs-JHG6vg&verifyHash=251347c79a64b603c3f1fdf320a810942077da0f
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: HTTP/1.1
Server: 65.9.42.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-42-87.nrt12.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 28 Apr 2022 03:58:06 GMT
Via: 1.1 ff66d77b2fbbd5ceabf14ca5c7712eb6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT12-C5
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: bc40af7914465b91
X-Amz-Cf-Id: gSYeM7L1_W7uFDxnzYzWua6ctZHEDPbUfYmyKErC2nk6Zwe-WQ-dWw==

Redirect headers

Date: Thu, 28 Apr 2022 03:58:05 GMT
Via: 1.1 ff66d77b2fbbd5ceabf14ca5c7712eb6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT12-C5
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AADRNk7E1CIAADs-JHG6vg&verifyHash=251347c79a64b603c3f1fdf320a810942077da0f
Connection: keep-alive
trace-id: 04a1006833336952
Content-Length: 0
X-Amz-Cf-Id: b8L2YzInAXn8EXKy9EohSjDISMGmFxcsxccYri1vfiwU2msE0uxBvQ==

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://id.rlcdn.com/464526.gif
https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCM2hqJMGEgUI6AcQAEIASgA
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297h64Iej_mvrx-QMZqmD2blS3vrC_EsRLBkqokxD2SYLU
https://segments.company-target.com/validateCookie?vendor=liveramp&user_id=Xc1297h64Iej_mvrx-QMZqmD2blS3vrC_EsRLBkqokxD2SYLU&verifyHash=776dd1f79dd4737b5a87e3700f1b86eea6ce316

26 B
409 B

162ms
162ms

Image
image/gif

65.9.42.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=liveramp&user_id=Xc1297h64Iej_mvrx-QMZqmD2blS3vrC_EsRLBkqokxD2SYLU&verifyHash=776dd1f79dd4737b5a87e3700f1b86eea6ce316
Requested by: Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/
Protocol: HTTP/1.1
Server: 65.9.42.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-42-87.nrt12.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 28 Apr 2022 03:58:06 GMT
Via: 1.1 929439fc8008e1e199a09db4822463c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT12-C5
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 67c1fd4a7b1354ac
X-Amz-Cf-Id: tZiE7WTTBOUAekfUAF0bXC3mTVjPWr73u7SiTWeywA3MsyaoQeMoaw==

Redirect headers

Date: Thu, 28 Apr 2022 03:58:05 GMT
Via: 1.1 929439fc8008e1e199a09db4822463c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT12-C5
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=liveramp&user_id=Xc1297h64Iej_mvrx-QMZqmD2blS3vrC_EsRLBkqokxD2SYLU&verifyHash=776dd1f79dd4737b5a87e3700f1b86eea6ce316
Connection: keep-alive
trace-id: 70b2cd988c54b576
Content-Length: 0
X-Amz-Cf-Id: ZdEoiV0NcZJ3hemrfNqq9j_VBCB4TcOxM1Fc9cJRhPXvKZHBO1fA4A==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ 3 KB
2 KB 127ms
44ms Script
text/javascript 2404:6800:4004:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1651118285626&cv=9&fst=1651118285626&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa4p0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&tiba=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:827::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ca1c8487c0d3be03e45faf13286ff0ddd44221cc2b7640763d304b3f4eb2db5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1178
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/743773256/ 42 B
64 B 86ms
41ms Image
image/gif 2404:6800:4004:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/743773256/?random=1651118285626&cv=9&fst=1651114800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa4p0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&tiba=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&async=1&fmt=3&is_vtc=1&random=64533334&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4004:813::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.co.jp/pagead/1p-user-list/743773256/ 42 B
154 B 53ms
44ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/743773256/?random=1651118285626&cv=9&fst=1651114800000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa4p0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&tiba=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&async=1&fmt=3&is_vtc=1&random=64533334&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clarity.js Show response
h.clarity.ms/s/0.6.34/ 53 KB
23 KB 494ms
160ms Script
application/javascript 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/s/0.6.34/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/4015302.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 03:58:06 GMT
content-encoding: br
etag: "1d84ce176162e54"
last-modified: Sun, 10 Apr 2022 13:47:04 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

OPTIONS
H/1.1 200
OK validateCookie
segments.company-target.com/ Frame 0
0 162ms
161ms Preflight 65.9.42.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segments.company-target.com/validateCookie?vendor=mariposa&user_id=example.com&verifyHash=7cdb852a4f27746567720bd43a965d467849527a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.42.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-42-87.nrt12.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://nakedsecurity.sophos.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Max-Age: 3600
Connection: keep-alive
Content-Length: 0
Date: Thu, 28 Apr 2022 03:58:05 GMT
Vary: Origin
Via: 1.1 55c659e0e2fe3ace02c4b6599c432138.cloudfront.net (CloudFront)
X-Amz-Cf-Id: uevgeBl7F376UcmB6Wm5SzBEQXu8zpa1_m6pJL2vWrJDS6Bv7mbmwA==
X-Amz-Cf-Pop: NRT12-C5
X-Cache: Miss from cloudfront
trace-id: b21e8b2138816dd4

POST
H3 200 / Show response
www.facebook.com/tr/ Frame CF83 0
18 B 6ms
2ms Document
text/plain 2a03:2880:f10f:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: nakedsecurity.sophos.com
URL: https://nakedsecurity.sophos.com/ja/2019/02/14/inside-a-gandcrab-targeted-ransomware-attack-on-a-hospital/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://nakedsecurity.sophos.com
Referer: https://nakedsecurity.sophos.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://nakedsecurity.sophos.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 28 Apr 2022 03:58:05 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 65 B
292 B 173ms
172ms Stylesheet
text/css 34.193.254.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.254.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-254-175.compute-1.amazonaws.com
Software: /
Resource Hash: 6710336043391448bc6b7e37a214f65e7806a9821d0f04d2d5127e348fa7fada

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 28 Apr 2022 03:58:06 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 65
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 681ms
170ms Fetch
image/jpeg 34.193.254.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.254.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-254-175.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 28 Apr 2022 03:58:06 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=6D291DF209DA4A17B4CE91A355433683&RedC=c.clarity.ms&MXFR=173EBAD054F968263358AB4450F966DD
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6D291DF209DA4A17B4CE91A355433683&MUID=2DD1BD68EDBF61930102ACFCEC4D60C8

42 B
443 B

31ms
31ms

Image
image/gif

52.231.207.240
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6D291DF209DA4A17B4CE91A355433683&MUID=2DD1BD68EDBF61930102ACFCEC4D60C8
Protocol: H2
Server: 52.231.207.240 Busan, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:06 GMT
last-modified: Thu, 17 Mar 2022 17:20:31 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "922c44e233ad81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 28 Apr 2022 03:58:05 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DF85F079CD23489092900ACBB8BD3E27 Ref B: TYBEDGE0520 Ref C: 2022-04-28T03:58:06Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6D291DF209DA4A17B4CE91A355433683&MUID=2DD1BD68EDBF61930102ACFCEC4D60C8
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2

200

/ Show response
match.adsrvr.org/track/upb/ Frame E3CC
Redirect Chain

https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0
https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0

927 B
1 KB

7ms
6ms

Document
text/html

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 509149c2ebf28cff24b64cfe49021d20384950901ae8518511e20bab94f6b4c9

Request headers

Referer: https://nakedsecurity.sophos.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html; charset=utf-8
date: Thu, 28 Apr 2022 03:58:06 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

Redirect headers

cache-control: private,no-cache, must-revalidate
content-type: text/html; charset=utf-8
date: Thu, 28 Apr 2022 03:58:06 GMT
location: https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1 200
OK universal_pixel.1.1.0.js Show response
js.adsrvr.org/ Frame E3CC 487 B
964 B 3ms
3ms Script
application/x-javascript 13.225.163.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Requested by: Host: match.adsrvr.org
URL: https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&upid=ql4fc2b&upv=1.1.0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.163.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-163-123.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6d7e9dafd1ec463ecd0c6b20f170400dd15afe81c71dea50771550df2f83ffc

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://match.adsrvr.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Wed, 27 Apr 2022 14:07:27 GMT
Via: 1.1 e77892dd431d44863ad00701fe285932.cloudfront.net (CloudFront)
Last-Modified: Thu, 24 Sep 2020 15:15:32 GMT
Server: AmazonS3
Age: 49840
ETag: "f0a7a3296da7382ce6bc1a3b6769e927"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
X-Amz-Cf-Pop: NRT12-C4
Accept-Ranges: bytes
Content-Length: 487
X-Amz-Cf-Id: 45pYY1j1_nQFNGwCLusmHqAjZkIn92CAVh6tf1VGs75ifY3QYkjbOA==

GET
H2

200

generic Show response
match.adsrvr.org/track/cmf/ Frame 8A37
Redirect Chain

https://ups.analytics.yahoo.com/ups/55953/sync?uid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&_origin=1&redir=true&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-IjoFCg9E2uJArC3ztDqNaCji2KKr63I-~A&gdpr=0&gdpr_consent=

70 B
586 B

4ms
4ms

Document
image/gif

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-IjoFCg9E2uJArC3ztDqNaCji2KKr63I-~A&gdpr=0&gdpr_consent=
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Thu, 28 Apr 2022 03:58:06 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

Redirect headers

age: 0
content-length: 0
date: Thu, 28 Apr 2022 03:58:06 GMT
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-IjoFCg9E2uJArC3ztDqNaCji2KKr63I-~A&gdpr=0&gdpr_consent=
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server: ATS/9.1.0.46
strict-transport-security: max-age=31536000

GET
H2

200

google Show response
match.adsrvr.org/track/cmf/ Frame A949
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NWE3ZDdiNDAtM2U1YS00YjIxLWE4YTMtNTA3NmM4ZTU3Nzcz&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&google_gid=CAESEM9kWZkKd_ysBqDqyUj1jNU&google_cver=1

70 B
586 B

6ms
5ms

Document
image/gif

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&google_gid=CAESEM9kWZkKd_ysBqDqyUj1jNU&google_cver=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Thu, 28 Apr 2022 03:58:06 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 386
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Apr 2022 03:58:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&google_gid=CAESEM9kWZkKd_ysBqDqyUj1jNU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2

200

rubicon Show response
match.adsrvr.org/track/cmf/ Frame A8A9
Redirect Chain

https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=5a7d7b40-3e5a-4b21-a8a3-5076c8e57773&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

70 B
586 B

6ms
5ms

Document
image/gif

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Thu, 28 Apr 2022 03:58:07 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
Expires: 0
Location: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
X-RPHost: 5e3ed5b16ff95387d0b9d1c5e78ff6a2
content-length: 0

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 94 B
406 B 173ms
173ms XHR
text/plain 34.193.254.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnakedsecurity.sophos.com%2Fja%2F2019%2F02%2F14%2Finside-a-gandcrab-targeted-ransomware-attack-on-a-hospital%2F&t=%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%20GandCrab%20%E3%81%AB%E3%82%88%E3%82%8B%E6%94%BB%E6%92%83%E3%81%AE%E8%A7%A3%E8%AA%AC%20%E2%80%93%20Naked%20Security&host=https://nakedsecurity.sophos.com
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.254.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-254-175.compute-1.amazonaws.com
Software: /
Resource Hash: 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nakedsecurity.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 28 Apr 2022 03:58:06 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://nakedsecurity.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 94

POST
H2 204 collect Show response
h.clarity.ms/ 0
76 B 360ms
359ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: h.clarity.ms
URL: https://h.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://nakedsecurity.sophos.com/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: https://nakedsecurity.sophos.com
date: Thu, 28 Apr 2022 03:58:06 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

POST
H2 204 collect Show response
h.clarity.ms/ 0
48 B 160ms
160ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: h.clarity.ms
URL: https://h.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://nakedsecurity.sophos.com/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: https://nakedsecurity.sophos.com
date: Thu, 28 Apr 2022 03:58:08 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

53 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sophos.com/	1970-01-20 06:57:50	Name: CampaignID Value: 70130000001xGqlAAE
www.sophos.com/	1969-12-31 23:59:59	Name: akacd_pr01 Value: 3828571084~rv=1~id=a04f1f07a3217b2231ff19973f024dc3
.sophos.com/	1970-01-20 04:48:14	Name: _gcl_au Value: 1.1.1444653926.1651118285
.sophos.com/	1970-01-20 20:09:50	Name: __utma Value: 1.630175758.1651118285.1651118285.1651118285.1
.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 1
.sophos.com/	1970-01-20 07:01:26	Name: __utmz Value: 1.1651118285.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.sophos.com/	1970-01-20 02:38:38	Name: __utmt Value: 1
.sophos.com/	1970-01-20 02:38:40	Name: __utmb Value: 1.1.10.1651118285
.nakedsecurity.sophos.com/	1970-01-20 20:09:50	Name: __utma Value: 222203399.1907354587.1651118285.1651118285.1651118285.1
.nakedsecurity.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 222203399
.nakedsecurity.sophos.com/	1970-01-20 07:01:26	Name: __utmz Value: 222203399.1651118285.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.nakedsecurity.sophos.com/	1970-01-20 02:38:38	Name: __utmt_ns Value: 1
.nakedsecurity.sophos.com/	1970-01-20 02:38:40	Name: __utmb Value: 222203399.1.10.1651118285
.bing.com/	1970-01-20 12:00:14	Name: MUID Value: 2DD1BD68EDBF61930102ACFCEC4D60C8
.bat.bing.com/	1970-01-20 02:48:43	Name: MR Value: 0
.sophos.com/	1970-01-20 02:40:04	Name: _uetsid Value: 685d6c40c6a711ec84070bab2a4d5781
.sophos.com/	1970-01-20 12:00:14	Name: _uetvid Value: 685db1d0c6a711eca7d447ee84860c77
.sophos.com/	1970-01-20 04:48:14	Name: _fbp Value: fb.1.1651118285467.1384213760
.facebook.com/	1970-01-20 04:48:14	Name: fr Value: 0POudeJauFDe2y38J..BiahDN...1.0.BiahDN.
.linkedin.com/	1970-01-20 04:48:14	Name: li_sugr Value: e4577f35-c34d-419c-ad3f-9234f31fd2bb
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 20:10:32	Name: bcookie Value: "v=2&0065764b-1319-4102-8db1-4a12b26c84fc"
.linkedin.com/	1970-01-20 02:40:04	Name: lidc Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2491:u=1:x=1:i=1651118285:t=1651204685:v=2:sig=AQGR-Sz4Ft6cz752EBw6zaAGT6pU9517"
.bidr.io/	1970-01-20 12:07:11	Name: bito Value: AADRNk7E1CIAADs-JHG6vg
.bidr.io/	1970-01-20 12:07:11	Name: bitoIsSecure Value: ok
.rlcdn.com/	1970-01-20 11:24:14	Name: rlas3 Value: IgecbU6YHuvwXHw99xmffEJNX+vPpdRut+5ktwVB/8k=
.linkedin.com/	1970-01-20 03:21:50	Name: UserMatchHistory Value: AQJZ5NsUvDzxTAAAAYBuUaMlc9SBHM_hpFiA6hPvArS9tLMMs2dQBTu1d1YHwN6JdycRzJdPbkB4BQ
.linkedin.com/	1970-01-20 03:21:50	Name: AnalyticsSyncHistory Value: AQJEpdnNpsEn_gAAAYBuUaMlNjQyytGFI9LQndaDUuaJNTq1S7tZc09NfFd-mFjpvRNYUJQu0WNdO-hdNfKwVw
.yahoo.com/	1970-01-20 11:24:35	Name: A3 Value: d=AQABBM0QamICEIllQavslCCkCvSPR4dnRw8FEgEBAQFia2JzYgAAAAAA_eMAAA&S=AQAAAkD3qJhPVwL9CbfQxpX08LE
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.www.linkedin.com/	1970-01-20 20:10:32	Name: bscookie Value: "v=1&20220428035805f400f611-43d9-4442-863f-8d058d76fc09AQFQVUq0yruOprLNb2s2FrTspCNMXLFh"
.rlcdn.com/	1970-01-20 04:05:02	Name: pxrc Value: CM2hqJMGEgUI6AcQABIGCMrdKhAA
.twitter.com/	1970-01-20 20:09:50	Name: personalization_id Value: "v1_8DU6QWWGj2Z128A7iy5e9A=="
.t.co/	1970-01-20 20:09:50	Name: muc_ads Value: 4507c3a5-251d-482e-b2b9-d08b0aa8fd4b
.company-target.com/	1970-01-20 20:09:50	Name: tuuid_lu Value: 1651118285
.company-target.com/	1970-01-20 20:09:50	Name: tuuid Value: 5deb0729-8c9d-4c9b-b1e5-7be34cd4b0d6
tags.srv.stackadapt.com/	1970-01-20 11:24:14	Name: sa-user-id Value: s%3A0-30f8e00f-4f67-4f9c-6db1-deccf75bac72.aYR%2FBEuJb35T6UMxpePsWNq9qFDbngSqgt8CZ08WDlY
.srv.stackadapt.com/	1970-01-20 11:24:14	Name: sa-user-id-v2 Value: s%3AMPjgD09nT5xtsd7M91usctmK_DU.d0R6nZf6%2FuWwc2wqdH2QPCFMzRUcfU4Z4DJQcKAqdqQ
.adsymptotic.com/	1970-01-20 04:48:14	Name: U Value: 3795bad5acabb021b925118322c2d7ab
.sophos.com/	1970-01-20 11:24:14	Name: _clck Value: 1ijf7w0\|1\|f10\|0
.adsrvr.org/	1970-01-20 11:24:14	Name: TDID Value: 5a7d7b40-3e5a-4b21-a8a3-5076c8e57773
.analytics.yahoo.com/	1970-01-20 11:24:14	Name: IDSYNC Value: 1769~24kr
.c.bing.com/	1970-01-20 02:48:43	Name: MR Value: 0
.c.bing.com/	1970-01-20 12:00:14	Name: SRM_B Value: 2DD1BD68EDBF61930102ACFCEC4D60C8
.doubleclick.net/	1970-01-20 20:09:50	Name: IDE Value: AHWqTUmuU7CLhVoSK9qGCqDkJorc8u2hY9rn8HqvwjAWwYq9dSnJOSeMCJniSdGiaWw
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 12:00:14	Name: MUID Value: 2DD1BD68EDBF61930102ACFCEC4D60C8
.c.clarity.ms/	1970-01-20 02:48:43	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 02:38:38	Name: ANONCHK Value: 0
.sophos.com/	1970-01-20 02:40:04	Name: _clsk Value: 1sa4app\|1651118286980\|1\|1\|h.clarity.ms/collect
.rubiconproject.com/	1970-01-20 11:24:14	Name: khaos Value: L2IH73Y0-B-9JT
.rubiconproject.com/	1970-01-20 11:24:14	Name: audit Value: 1\|fdfg4/yQ4nFF297InQGuRJ4/NV5zueCIL8ZHxthVVSyuYhAoxminfw6TskHemsL2slkONIxvAuZw0S94mtzOH0pB9H8pjytykCdHvyxZSdbF+bKEg4Qy0Y2aujtPRxyLfpi9FZYNLciKz9EwMfs37UOxAs1VSNw9i8N7BAmaQgdJt49mPrPRUFyo1mMSXCQ85kHVXO4iITS/uI9Aj+Yjkr7KKI+4mJy3oGirqm5gUhh8KMm0j6uXBGY3KwFBcKEE94+z9/eToJrLtHkR71fkUv/JTzblBZm7jOq1oSpaE+yma+WVcS1g3g==
.adsrvr.org/	1970-01-20 11:24:14	Name: TDCPM Value: CAESGQoKcmlnaHRtZWRpYRILCKyRhNqqtdQ6EAUSFQoGZ29vZ2xlEgsIgNyv26q11DoQBRIWCgdydWJpY29uEgsIrJGE2qq11DoQBRgFIAMoAzILCKyJh4fBtdQ6EAVCDyINCAESCQoFdGllcjIQAVoHajAyMnhsamAB

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
analytics.twitter.com
api.company-target.com
bat.bing.com
c.bing.com
c.clarity.ms
cm.g.doubleclick.net
connect.facebook.net
googleads.g.doubleclick.net
h.clarity.ms
id.rlcdn.com
img03.en25.com
insight.adsrvr.org
js.adsrvr.org
match.adsrvr.org
match.prod.bidr.io
nakedsecurity.sophos.com
p.adsymptotic.com
pixel.rubiconproject.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
s.yimg.com
scripts.demandbase.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
stats.wp.com
t.co
tags.srv.stackadapt.com
ups.analytics.yahoo.com
www.facebook.com
www.google.co.jp
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.sophos.com
104.18.101.194
104.244.42.133
104.244.42.3
106.10.236.146
13.107.42.14
13.114.99.218
13.225.163.123
143.204.73.109
143.204.73.11
151.101.108.157
151.101.193.2
172.217.161.66
18.178.52.42
184.26.249.60
192.0.76.3
23.36.105.121
2404:6800:4004:801::2003
2404:6800:4004:813::2004
2404:6800:4004:81f::2008
2404:6800:4004:822::2008
2404:6800:4004:827::2002
2404:6800:4008:c13::9d
2406:2000:a4:9fe::
2600:140b:2::174d:ccb0
2620:1ec:21::14
2620:1ec:c11::200
2a03:2880:f00f:8:face:b00c:0:1
2a03:2880:f10f:83:face:b00c:0:25de
2a04:fa87:fffd::c000:42c8
3.33.220.150
34.193.254.175
35.190.60.146
52.224.31.34
52.231.207.240
54.204.196.80
65.9.42.87
8.39.36.141
061473d06c676e692148c9e53870122e472f133abc759c56e871a162e79b9376
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
10354e9bc6b485028971a1f58fccff5c89d722db324d42bc07963aab24ebb956
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
14662aba6fd932277ae74140fc4e0c46fa8b3bf3999919454036be05851055d1
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
161e1d347ed141e560fdff4e56964d7fa41834bdbc779b2c59722ac15e50f0cb
1621e7c862be84cd5d2cd8e4b3a4d8382b853714d6ca0a57da9a04b115a42364
1a49a2cffa6dda5993f1571558d44644ad9517dfa370fbb7b0e9d005d33fc7bc
1b15df54cdbcf927d9ca83dec5a5804283f3a3aae0d1a787897b516690ff5d1e
2ca1c8487c0d3be03e45faf13286ff0ddd44221cc2b7640763d304b3f4eb2db5
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
350448de4029a22317c409036bcc063e6ad7f8a80b269f71da6eed7563c3b30f
3acf98b85a977f8028e3aacb5fdc77649de1578754e5b08492361c7a72efc535
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
40a36fd024a865b9e3e97ad53606eeece383ce012bd8d63aa2dfc854c7d04e9a
4503e524f77aba44b36b834f2f8efc08a48189f7915ed42956b151c9afb55c1f
4902dcbc3d3c97271a66bc136ec40b0c72422ccd05bb9946aa76382e50c5d6fc
4c1c083090007e0e9bd466628c5b82c4e0ac29f501b7049bd0744b2160fb49bf
4c331a19f481eb536fa4ddc75c1c8808057f1357bcf8c61e6ab963b6dc2a6907
4ee90bd9f521aa1bcea667322a0fd33bf3a3ba12e5ca0e2d088bda560a9eef19
509149c2ebf28cff24b64cfe49021d20384950901ae8518511e20bab94f6b4c9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5e153ac5bbf2518558464952c22a5bc20b349fa2e2921f853e3d1f75645348b9
6280af26ccd34631a90de8cc4f33e915d39720dd7767ea8a2042e1864dd0819a
63ee1658cac1b7a77753a1bf9e9fc5e7a05e73426e608fef3f2b482a1f0c71ae
6710336043391448bc6b7e37a214f65e7806a9821d0f04d2d5127e348fa7fada
6ddecf084e5b6ed52ab9c8143890a72a3d695edee6fafbf4ca5128a7cd6f1b3f
707d0980b1c65b912c943b578c3a576a01ed96cab83b0e6b8bd6602b9835066c
70d4c4423dab9cf00b6e9bcf57518eeafff00e9d2499f4463498b03bef2bdc33
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
759c08870ec11ea02ee31178d93da8b3613e8c8433c2954f07c7f5edb3be8a91
7dab67b04713996fdffb35641b4f7193b794a38dae237c0128edb7bf368f4966
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
86d72c164d9cec2913a0c7fd7b5f994ab5436b819fc68c68f5892efaf8db4778
86f388a06affc92020302d848bc31e5df0593256b24bfe1c1a9d8d3d8e70915a
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ddfbc2df97c0bef954c871b7bed49d48473c52b6a6d20677503863c0b546efb
964dd54dd651e6c51d925cd29df29d85678781f357444e148522b04bb0a28bf4
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
afd332f0a541472efd7be7b6e231b5b2df9a3412dcaced67bc66808db493fea5
b0a63a118c83ee872479df62851952db56d1d01f6dad0b148b3522b7b712d47d
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
b2fe29d1813dd78bc44fcb57c65740ee5965fe6985c5c69d9576e0c0a9b5fe5f
b9c50509faf1e3869ddc7635ee438f1cb0f80c2dab1983ee2c24376145c2bf5b
bf45a939fd9e6d74a7acc1b575d73088396888717272bb8643c2b5479afea4a2
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
cb1d2a9330cdf370943a7c6ed01b6d93e54575b4cc7b8abb665e2ef7ddf079ba
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d85e8f32872c1fd6438f8a355f4b7226b5af9ba87474e590cc352f6cd16d2d9a
e062f5843f223fb2222333e6cca83f64b1d307875aeca187aec1a3055f3157b1
e1b293d96560e1b12aafc0b0798ead6291de4c789c78671fff5609cea24aeedc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4aadbfb76725939385602738ef216b5f75ee5a3d3824d82be9862c43bb1b079
e8eab802d8a017af747aeb8abd3c937420e3f0a2c0f3d06828df322e620c6867
edfc15c6d8e105511ebc6f81ca49ec279a1f608c5b9e465cf37a56baba09750b
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f02048fc30cf09f21fabfee36fb76feb7c239a3b6b0a011e6c5ab4c91422fd0b
f05a815262962493146cae3d7370bfa4c5d488fc8630e5caf861f33f2ede341d
f06210c8e0ec5ba4f4679ba1c9a301176def4a552f29388629ddaef7320681ba
f09c53ca35858cba3d65ebcc619e4ff5d68ab5590391d3f0bb0fdca57a89d816
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f6d7e9dafd1ec463ecd0c6b20f170400dd15afe81c71dea50771550df2f83ffc

nakedsecurity.sophos.com Open in urlscan Pro 2a04:fa87:fffd::c000:42c8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

85 Requests

92 %HTTPS

35 %IPv6

29 Domains

42 Subdomains

30 IPs

8 Countries

815 kBTransfer

2038 kBSize

53 Cookies

49 Outgoing links

Page URL History

Redirected requests

85 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

nakedsecurity.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8 Public Scan

Screenshot
Live screenshot

Full Image

85
Requests

92 %
HTTPS

35 %
IPv6

29
Domains

42
Subdomains

30
IPs

8
Countries

815 kB
Transfer

2038 kB
Size

53
Cookies

85 HTTP transactions
0 data transactions