www.tripwire.com Open in urlscan Pro
192.229.182.232  Public Scan

16 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 41

• https://www.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs HTTP 302
• https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs

Request Chain 50

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072044469/?value=0&guid=ON&script=0 HTTP 302
• https://www.google.com/pagead/1p-user-list/1072044469/?value=0&guid=ON&script=0&is_vtc=1&random=477380023 HTTP 302
• https://www.google.de/pagead/1p-user-list/1072044469/?value=0&guid=ON&script=0&is_vtc=1&random=477380023&ipr=y

Request Chain 52

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72911&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&time=1577978848006 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D72911%26url%3Dhttps%253A%252F%252Fwww.tripwire.com%252Fstate-of-security%252Ffeatured%252Fbadrabbit-runs-steam-prepared-next-ransomware-attack%252F%26time%3D1577978848006%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72911&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&time=1577978848006&liSync=true

Request Chain 54

• https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1499726495&t=pageview&_s=1&dl=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&ul=en-us&de=UTF-8&dt=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEADQ~&jid=1968655858&gjid=2085626784&cid=1227953340.1577978848&tid=UA-1168187-1&_gid=1604963552.1577978848&_r=1&gtm=2wgc61KW8LTBX&cd6=OCT%2026%2C%202017&cd7=GRAHAM%20CLULEY&z=405502620 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_gid=1604963552.1577978848&gjid=2085626784&_v=j79&z=405502620 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_v=j79&z=405502620 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_v=j79&z=405502620&slf_rd=1&random=1125331008

Request Chain 71

• https://syndication.twitter.com/i/jot HTTP 302
• https://platform.twitter.com/jot.html

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/	64 KB 16 KB	3270ms 139ms	Document text/html	192.229.182.232 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.182.232 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software nginx / WP Engine Resource Hash 3e752a0b26337ec6df0364e73ea8cf8a101396a67008f1fe2e77f1dea9b9ea54 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.tripwire.com :scheme https :path /state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 content-encoding gzip cache-control max-age=600, must-revalidate content-type text/html; charset=UTF-8 date Thu, 02 Jan 2020 15:27:27 GMT link <https://www.tripwire.com/state-of-security/wp-json/>; rel="https://api.w.org/" </state-of-security/?p=48169>; rel=shortlink p3p CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM" server nginx vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 1 x-cache-group normal x-cacheable SHORT x-frame-options SAMEORIGIN x-pass-why x-pingback https://www.tripwire.com/state-of-security/xmlrpc.php x-powered-by WP Engine
GET H2	200	style.min.css 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-includes/css/dist/block-library/	40 KB 6 KB	68ms 17ms	Stylesheet text/css	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-includes/css/dist/block-library/style.min.css?ver=5.3.2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Tue, 05 Nov 2019 22:06:04 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"5dc1f24c-a1fb" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type text/css status 200 cache-control public, max-age=31536000
GET H2	200	base.theme.css 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/	263 KB 38 KB	81ms 31ms	Stylesheet text/css	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 10ea978fd48a562ee7114415520f7650c7170bc6f489852ed6027a96cfab3436 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Tue, 01 Oct 2019 16:16:57 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"5d937bf9-41bc2" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type text/css status 200 cache-control public, max-age=31536000
GET H2	200	styles.css 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/youtube-channel-gallery/	21 KB 3 KB	92ms 42ms	Stylesheet text/css	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/youtube-channel-gallery/styles.css?ver=5.3.2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash ec1385eb1bb1b40220bff6eb2e22281159a479fc6182d3d83a1602ca928b947c Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:27 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9b-53e6" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type text/css status 200 cache-control public, max-age=31536000
GET H2	200	magnific-popup.css 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/youtube-channel-gallery/	8 KB 2 KB	90ms 40ms	Stylesheet text/css	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/youtube-channel-gallery/magnific-popup.css?ver=5.3.2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 43880ba0f8c46ad7286df3e830b0da0aaadba17c89186512fc4e2c2eaae36966 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:27 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9b-1e7d" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type text/css status 200 cache-control public, max-age=31536000
GET H2	200	logo-tripwire.svg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/logo/	3 KB 2 KB	95ms 45ms	Image image/svg+xml	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/logo/logo-tripwire.svg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 0e0ef035ca58b04d60df0ffcdf08dc0974488b77fa92ceb64d25f8c036a81854 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:26 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9a-b9b" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type image/svg+xml status 200 cache-control public, max-age=31536000
GET H2	200	cluley-portrait-125.jpeg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	11 KB 11 KB	95ms 45ms	Image image/jpeg	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/cluley-portrait-125.jpeg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash f852d348cf0b59dc45d280f6d126af65dca21d59fc884267f4e51ca63df4226a Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Fri, 27 Jan 2017 03:10:45 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "588aba35-2bf2" vary Accept-Encoding x-cache HIT content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 11250
GET H2	200	badrabbit.jpeg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	61 KB 61 KB	420ms 417ms	Image image/jpeg	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/badrabbit.jpeg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 7f8b2327da835018cc73b308d2feb99ca5ae8352aabaae5d5df295b6def87684 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT last-modified Thu, 26 Oct 2017 11:18:51 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "59f1c49b-f334" vary Accept-Encoding x-cache MISS content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 62260
GET H2	200	facebook.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/	2 KB 3 KB	27ms 24ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/facebook.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash bc25d54e4ad0ccc1e7a8a0a136c6fb5b13f004492f95746bd464623ee4f0f413 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Wed, 03 Jul 2019 20:16:31 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5d1d0d1f-9a1" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 2465
GET H2	200	twitter.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/	9 KB 9 KB	27ms 25ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/twitter.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 6c9a0f0767d7a8d2f367ff172ae2a16a86a2ff09e44aafa60dbc093ccc249643 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Wed, 03 Jul 2019 20:16:32 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5d1d0d20-229e" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 8862
GET H2	200	linkedin.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/	8 KB 8 KB	28ms 25ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/linkedin.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash fcf9c6f1534e797c9c0876371e6e6853eee87442da3d9281d831245351421c0d Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Wed, 03 Jul 2019 20:16:31 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5d1d0d1f-20b7" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 8375
GET H2	200	reddit.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/	3 KB 3 KB	28ms 26ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/reddit.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 4fbc4ccb328cb5d12e21c1a698fa8fa698ef4b79fcdfc97ac5f069df10f60655 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Wed, 03 Jul 2019 20:16:31 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5d1d0d1f-cdd" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 3293
GET H2	200	email.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/	17 KB 17 KB	29ms 27ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img/social/email.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash be0de05d0e2217bad49b8c11046edc7759f1c74bee758ef547582704048f7be5 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Wed, 03 Jul 2019 20:16:31 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5d1d0d1f-423b" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 16955
GET H2	200	1x1.trans.gif 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/lazy-load/images/	42 B 267 B	30ms 27ms	Image image/gif	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/lazy-load/images/1x1.trans.gif Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Fri, 27 Jan 2017 03:12:28 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "588aba9c-2a" vary Accept-Encoding x-cache HIT content-type image/gif status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 42
GET H2	200	fake-adobe-update.jpeg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	38 KB 38 KB	419ms 417ms	Image image/jpeg	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/fake-adobe-update.jpeg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 01e66f7a4d27e1fdb87c3413db375acac70faf01490ab028c8f70fe923dc7106 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT last-modified Thu, 26 Oct 2017 11:50:32 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "59f1cc08-96e3" vary Accept-Encoding x-cache MISS content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 38627
GET H2	200	healthrec_tw_blogbottom.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	79 KB 79 KB	31ms 28ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/healthrec_tw_blogbottom.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 8dc1b11abc09281778bf9af470535c1a121e57f1d9d8be13f8ab435cc34c44c1 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Mon, 21 May 2018 09:39:32 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5b0293d4-13bc3" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 80835
GET H2	200	navigating.jpg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	44 KB 45 KB	36ms 34ms	Image image/jpeg	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/navigating.jpg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash f2bb19f5690a9eee556c27194972045813fdff4aff25d34e52ae31dbc341922c Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Thu, 21 Nov 2019 10:38:50 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5dd6693a-b122" vary Accept-Encoding x-cache HIT content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 45346
GET H2	200	DevOps-free-trial-Website-300x250.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	17 KB 18 KB	38ms 36ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/DevOps-free-trial-Website-300x250.png Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash b6b54a275d881b356dd411ef181dc0f9a7f4c3ba29234cdd86f63719d0407cc7 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Fri, 24 Aug 2018 12:42:03 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "5b7ffd1b-45d7" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 17879
GET H2	200	base.full.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/js/	460 KB 135 KB	21ms 21ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/js/base.full.js?ver=1.9.5&jq=1.11.0 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 107d74abbeeecf86d87f73d22593a11450799811724b451920e1bf727fa0a220 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:26 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9a-730a3" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	base.activation.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/js/	9 KB 4 KB	37ms 37ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/js/base.activation.js?ver=1.9.5&as=1.75 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash b696ea3ed5a837699ad37659568d1d82c45baf02fdc855e4fb7af8c8883ee7e8 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:25 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba99-2430" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	wpp-4.2.0.min.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/wordpress-popular-posts/public/js/	1 KB 832 B	20ms 16ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 9fd7bfa229eec86e2b02fdcf85e49e5b2699a2d9cd53ee36b4df53513d1da1f3 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Sat, 23 Feb 2019 16:49:05 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"5c717981-47b" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	jquery.sonar.min.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/lazy-load/js/	1 KB 969 B	20ms 17ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/lazy-load/js/jquery.sonar.min.js?ver=0.6.1 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash c3dd5c4ff63478b87ed9670be1b4c688725d53c9ff84a233cfec8ff2bb83a72d Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:28 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9c-580" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	lazy-load.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/lazy-load/js/	902 B 707 B	20ms 17ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/lazy-load/js/lazy-load.js?ver=0.6.1 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 40a7f2b25ea8c45af8993aa57c19e576ea8eab5cbe9f467d45d4be7a537e7a47 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:28 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9c-386" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	api.min.js Show response a.opmnstr.com/app/js/	196 KB 58 KB	50ms 15ms	Script application/javascript	23.111.11.182 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://a.opmnstr.com/app/js/api.min.js Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 7b1e6aa481d334ed5851b4efbe5625eb8288c73c69d0c961f17b7ef3e7632b52 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Mon, 23 Dec 2019 13:49:02 GMT server NetDNA-cache/2.2 x-amz-request-id FC709AE268A6169F etag W/"4c7f597c422fd52f4217bef284391319" x-cache HIT content-type application/javascript status 200 cache-control max-age=2592000 access-control-allow-origin * x-amz-id-2 84epq3712QVP6HZkpmhzR9E08KFOvovaHRS6KGqQ8UBLtsduikIcElsnVCiK2qYa expires Sat, 01 Feb 2020 15:27:27 GMT
GET H2	200	wp-embed.min.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-includes/js/	1 KB 992 B	21ms 18ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-includes/js/wp-embed.min.js?ver=5.3.2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Sat, 05 Oct 2019 19:49:10 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"5d98f3b6-577" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	comment-reply.min.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-includes/js/	2 KB 1 KB	22ms 19ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-includes/js/comment-reply.min.js?ver=5.3.2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 73eb139b1371aed55b1dce74b7258f2d90991c5294d69fce852c3eed1af40068 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Mon, 11 Nov 2019 16:59:02 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"5dc99356-951" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	ai.js Show response 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/advanced-iframe/js/	57 KB 13 KB	26ms 23ms	Script application/javascript	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/advanced-iframe/js/ai.js?ver=1 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash c1a42ec2dbc1c88c6a521f79e2e2902849e86868bb6d3004c187ea5292b2fb41 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Sat, 23 Feb 2019 16:48:29 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"5c71795d-e435" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript status 200 cache-control public, max-age=31536000
GET H2	200	bootstrap-toolkit.min.js Show response rawgit.com/maciej-gurban/responsive-bootstrap-toolkit/master/dist/	2 KB 1 KB	36ms 13ms	Script application/javascript	2606:4700:30::681b:8f9c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://rawgit.com/maciej-gurban/responsive-bootstrap-toolkit/master/dist/bootstrap-toolkit.min.js Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:8f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 944b1049eb1326e6787fd4a8f0e6e596d6a140ec11a7c313effc366a25f93694 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 287 cf-ray 54edc1d7497a640d-FRA status 200 alt-svc h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 sunset Tue, 01 Oct 2019 00:00:00 GMT rawgit-cache-status EXPIRED server cloudflare etag W/"25aed85d65ed145f16c92f80f69a8cdfb04189a0f7ca9735b689c5115537816c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; preload content-type application/javascript;charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control max-age=3600, s-maxage=300 x-robots-tag none link <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."
GET H2	200	bootstrap.css 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/	143 KB 22 KB	23ms 22ms	Stylesheet text/css	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/bootstrap.css Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 8621e066b73ecc9169f0e20ec3a987177df8d940273ec02c8265a75342af29fb Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Wed, 18 Oct 2017 20:36:08 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"59e7bb38-23a84" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type text/css status 200 cache-control public, max-age=31536000
GET H2	200	prum.min.js Show response rum-static.pingdom.net/	6 KB 3 KB	31ms 10ms	Script application/javascript	2606:4700:10::6814:15ef Cloudflare
General Check archive.org Show headers Download Go to Full URL https://rum-static.pingdom.net/prum.min.js Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:15ef , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2d659b59a4cf40320e19b273395524a19b1a354beceb07e791746aec927465c2 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 26 Jun 2019 09:19:43 GMT server cloudflare age 2366 etag W/"5d1338af-186f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 status 200 cache-control max-age=43200 cf-ray 54edc1d74c8996e0-FRA access-control-allow-origin *
GET H2	200	gtm.js Show response www.googletagmanager.com/	106 KB 34 KB	16ms 14ms	Script application/javascript	2a00:1450:4001:81e::2008 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-KW8LTBX Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 713be6e7e9467c860a5800036a9d943a2928f30999758a54c2c38fcefd6e0a06 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding br last-modified Thu, 02 Jan 2020 15:00:00 GMT server Google Tag Manager access-control-allow-origin http://www.googletagmanager.com vary Accept-Encoding content-type application/javascript; charset=UTF-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control content-length 34362 x-xss-protection 0 expires Thu, 02 Jan 2020 15:27:27 GMT
GET H2	200	logo-tripwire.svg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img//logo/	3 KB 2 KB	30ms 30ms	Image image/svg+xml	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img//logo/logo-tripwire.svg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 0e0ef035ca58b04d60df0ffcdf08dc0974488b77fa92ceb64d25f8c036a81854 Request headers Referer https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:26 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9a-b9b" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type image/svg+xml status 200 cache-control public, max-age=31536000
GET H2	200	MavenProLight300-Regular.woff2 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font//mavenpro/Light/300/	14 KB 15 KB	401ms 26ms	Font application/octet-stream	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font//mavenpro/Light/300/MavenProLight300-Regular.woff2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 93cb2ceed99ba109b940557c50f108ec19b2528cddf7b016296566a4f50b07b2 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 Origin https://www.tripwire.com Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip last-modified Wed, 18 Oct 2017 20:36:59 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"59e7bb6b-3940" vary Accept-Encoding x-cache HIT content-type application/octet-stream status 200 cache-control public, max-age=31536000
GET H2	200	MavenPro-Regular.woff2 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font//mavenpro/Regular/	24 KB 24 KB	414ms 38ms	Font application/octet-stream	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font//mavenpro/Regular/MavenPro-Regular.woff2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash e2c2a6d4df6d0be79c568781459e10188f8b9f278d38b45903c6925940146db9 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 Origin https://www.tripwire.com Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip last-modified Wed, 18 Oct 2017 20:37:02 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"59e7bb6e-5ee4" vary Accept-Encoding x-cache HIT content-type application/octet-stream status 200 cache-control public, max-age=31536000
GET H2	200	MavenPro-Medium.woff2 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font//mavenpro/Medium/	24 KB 24 KB	420ms 45ms	Font application/octet-stream	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font//mavenpro/Medium/MavenPro-Medium.woff2 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 1ce968394bf8a6a1f21fbf1f0151458cf9fa0bd9622f63e6cb4487aad67d5ce0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 Origin https://www.tripwire.com Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip last-modified Wed, 18 Oct 2017 20:37:01 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"59e7bb6d-5e80" vary Accept-Encoding x-cache HIT content-type application/octet-stream status 200 cache-control public, max-age=31536000
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	95 KB 29 KB	25ms 6ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40D0) / Resource Hash ff6a67b5b4c91cf683b9168393ce7aa41d64326a40b928809cdf7e15d0b3c8b8 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 02 Jan 2020 15:27:27 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 23:46:10 GMT Server ECS (fcn/40D0) Etag "a41dba1e30b9426e9a69c373d2c94042+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=1800 X-Cache HIT Content-Type application/javascript; charset=utf-8 Content-Length 28837
GET H2	200	icon-social-sprite.png 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img//icon/	7 KB 7 KB	18ms 18ms	Image image/png	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/img//icon/icon-social-sprite.png Requested by Host: 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com URL: https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/js/base.full.js?ver=1.9.5&jq=1.11.0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash 5e61bcf309342ddda6789982135173c8ac26aaca1218956b7374e2fc2dd696ac Request headers Referer https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT last-modified Fri, 27 Jan 2017 03:12:26 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "588aba9a-1a79" vary Accept-Encoding x-cache HIT content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 6777
GET H2	200	fontawesome-webfont.woff2 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font/awesome/	65 KB 65 KB	387ms 50ms	Font application/octet-stream	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/font/awesome/fontawesome-webfont.woff2?v=4.5.0 Requested by Host: 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com URL: https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/js/base.full.js?ver=1.9.5&jq=1.11.0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/themes/tw-base/assets/css/base.theme.css?ver=1.9.5 Origin https://www.tripwire.com Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 03:12:27 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag W/"588aba9b-10440" vary Accept-Encoding x-cache HIT content-type application/octet-stream status 200 cache-control public, max-age=31536000
POST H2	200	/ Show response www.tripwire.com/state-of-security/wp-json/wordpress-popular-posts/v1/popular-posts/	43 B 406 B	164ms 163ms	XHR application/json	192.229.182.232 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://www.tripwire.com/state-of-security/wp-json/wordpress-popular-posts/v1/popular-posts/ Requested by Host: 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com URL: https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.182.232 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software nginx / WP Engine Resource Hash da4c5fbd0d4e30a0dd065e17712319393e102f4234a7c2edfb3311c5d5fedf4b Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Origin https://www.tripwire.com X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff x-powered-by WP Engine p3p CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM" status 200 content-length 43 link <https://www.tripwire.com/state-of-security/wp-json/>; rel="https://api.w.org/" allow GET, POST server nginx x-frame-options SAMEORIGIN vary X-NR-SAMPLE-PERCENT,Origin access-control-allow-methods OPTIONS, GET, POST, PUT, PATCH, DELETE content-type application/json; charset=UTF-8 access-control-allow-origin https://www.tripwire.com x-wp-nonce 561a7da1e6 access-control-allow-credentials true x-robots-tag noindex access-control-allow-headers Authorization, Content-Type access-control-expose-headers X-WP-Total, X-WP-TotalPages
GET H2	200	fontanka-facebook.jpeg 3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/	69 KB 70 KB	334ms 334ms	Image image/jpeg	94.31.29.99 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/fontanka-facebook.jpeg Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.31.29.99 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS 94.31.29.99.IPYX-077437-ZYO.above.net Software NetDNA-cache/2.2 / Resource Hash d8792a2fd1d7d9a88b9354a1b653b0f6e85b63d4831c265914543ebbf9e47467 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT last-modified Thu, 26 Oct 2017 11:34:48 GMT server NetDNA-cache/2.2 access-control-allow-origin * etag "59f1c858-114ec" vary Accept-Encoding x-cache MISS content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 70892
GET H2	401	b1frktvq3cjhqa3h3mxh Show response api.opmnstr.com/v2/embed/5177/	164 B 378 B	480ms 286ms	XHR application/json	50.19.60.226 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://api.opmnstr.com/v2/embed/5177/b1frktvq3cjhqa3h3mxh Requested by Host: a.opmnstr.com URL: https://a.opmnstr.com/app/js/api.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.19.60.226 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-50-19-60-226.compute-1.amazonaws.com Software Pagely Gateway/1.5.1 / Resource Hash d381e8954db6178052f360fb1928057bd0a916c54cac1360a020477725ba1c19 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Origin https://www.tripwire.com Response headers x-user-agent standard x-cache-config 0 0 server Pagely Gateway/1.5.1 status 401 date Thu, 02 Jan 2020 15:27:28 GMT vary Accept-Encoding, User-Agent content-type application/json;charset=utf-8 access-control-allow-origin * access-control-allow-headers X-CSRF-Token content-length 164
GET H2	401	g3pn38rz6brthmz2adj3 Show response api.opmnstr.com/v2/embed/5177/	164 B 378 B	409ms 217ms	XHR application/json	50.19.60.226 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://api.opmnstr.com/v2/embed/5177/g3pn38rz6brthmz2adj3 Requested by Host: a.opmnstr.com URL: https://a.opmnstr.com/app/js/api.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 50.19.60.226 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-50-19-60-226.compute-1.amazonaws.com Software Pagely Gateway/1.5.1 / Resource Hash d381e8954db6178052f360fb1928057bd0a916c54cac1360a020477725ba1c19 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Origin https://www.tripwire.com Response headers x-user-agent standard x-cache-config 0 0 server Pagely Gateway/1.5.1 status 401 date Thu, 02 Jan 2020 15:27:28 GMT vary Accept-Encoding, User-Agent content-type application/json;charset=utf-8 access-control-allow-origin * access-control-allow-headers X-CSRF-Token content-length 164
GET H2	200	cse.js Show response cse.google.com/cse/ Redirect Chain https://www.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs	11 KB 4 KB	60ms 41ms	Script text/javascript	2a00:1450:4001:821::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software gws / Resource Hash ff4dc0f9b5dae9dc5a9e736318a991e4aaaa4d6983398d5602de4dd319624f35 Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding br server gws x-frame-options SAMEORIGIN p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." status 200 cache-control private content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 3491 x-xss-protection 0 expires Thu, 02 Jan 2020 15:27:28 GMT Redirect headers date Thu, 02 Jan 2020 15:27:27 GMT x-content-type-options nosniff server sffe location https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 267 x-xss-protection 0
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:814::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KW8LTBX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Aug 2019 17:22:41 GMT server Golfe2 age 3230 date Thu, 02 Jan 2020 14:33:37 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 17803 expires Thu, 02 Jan 2020 16:33:37 GMT
GET H/1.1	200 OK	insight.min.js Show response sjs.bizographics.com/	3 KB 2 KB	11ms 11ms	Script application/x-javascript	2a02:26f0:10c:38f::3adf AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sjs.bizographics.com/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KW8LTBX Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:38f::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 02 Jan 2020 15:27:27 GMT Content-Encoding gzip Last-Modified Mon, 07 Oct 2019 16:41:31 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=83693 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	26 KB 10 KB	76ms 31ms	Script text/javascript	172.217.22.98 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KW8LTBX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.98 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s18-in-f98.1e100.net Software cafe / Resource Hash 77ce0ec2a02b410eee12285bd7487b2599970ac39b6ff58c0b748b6e2df36f3c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9933 x-xss-protection 0 server cafe etag 9795501548502167919 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 02 Jan 2020 15:27:28 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	68ms 24ms	Script application/javascript	151.101.112.157 Fastly
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KW8LTBX Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software / Resource Hash 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip age 26043 x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 content-length 1954 x-served-by cache-hhn4036-HHN last-modified Tue, 23 Jan 2018 20:09:00 GMT x-timer S1577978848.036141,VS0,VE0 etag "b7b33882a4f3ffd5cbf07434f3137166+gzip" vary Accept-Encoding,Host content-type application/javascript; charset=utf-8 via 1.1 varnish cache-control no-cache accept-ranges bytes
GET H2	200	bat.js Show response bat.bing.com/	23 KB 7 KB	31ms 31ms	Script application/javascript	2620:1ec:c11::200 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:27 GMT content-encoding gzip last-modified Tue, 10 Sep 2019 18:57:28 GMT x-msedge-ref Ref A: 1A3D4899A8A543D3B4BD6385F0250C22 Ref B: FRAEDGE0820 Ref C: 2020-01-02T15:27:27Z access-control-allow-origin * etag "09c5197968d51:0" vary Accept-Encoding content-type application/javascript status 200 cache-control private,max-age=1800 accept-ranges bytes content-length 7148
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	77ms 26ms	Script application/x-javascript	95.101.176.176 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.176.176 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a95-101-176-176.deploy.static.akamaitechnologies.com Software Apache / Resource Hash f97341de4415531cb15d7472b1a00e875c1ad9b5541fd7e9f8ef5905f2a02092 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 02 Jan 2020 15:27:28 GMT Content-Encoding gzip Last-Modified Fri, 25 Oct 2019 16:30:39 GMT Server Apache ETag "521a36d038605fd35c0785cc62e39b0e:1572021039" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 766
GET H/1.1	200 OK	rtp.js Show response sjrtp4-cdn.marketo.com/rtp-api/v1/	0 231 B	232ms 29ms	Script application/x-javascript	95.100.75.224 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://sjrtp4-cdn.marketo.com/rtp-api/v1/rtp.js?aid=tripwire Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.75.224 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a95-100-75-224.deploy.static.akamaitechnologies.com Software Jetty(7.3.1.v20110307) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63113904 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Strict-Transport-Security max-age=63113904 Server Jetty(7.3.1.v20110307) Connection keep-alive Date Thu, 02 Jan 2020 15:27:28 GMT Content-Length 0 Content-Type application/x-javascript; charset=UTF-8
GET H2	200	conversion.js Show response www.googleadservices.com/pagead/	25 KB 10 KB	75ms 34ms	Script text/javascript	172.217.22.98 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KW8LTBX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.98 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s18-in-f98.1e100.net Software cafe / Resource Hash 1e7f38ad3228c18e42d333db1c37196568540a54143a158af008393e2a7a5217 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9872 x-xss-protection 0 server cafe etag 10799607792090409869 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 02 Jan 2020 15:27:28 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1072044469/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072044469/?value=0&guid=ON&script=0 https://www.google.com/pagead/1p-user-list/1072044469/?value=0&guid=ON&script=0&is_vtc=1&random=477380023 https://www.google.de/pagead/1p-user-list/1072044469/?value=0&guid=ON&script=0&is_vtc=1&random=477380023&ipr=y	42 B 110 B	21ms 20ms	Image image/gif	2a00:1450:4001:824::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1072044469/?value=0&guid=ON&script=0&is_vtc=1&random=477380023&ipr=y Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff server cafe timing-allow-origin * location https://www.google.de/pagead/1p-user-list/1072044469/?value=0&guid=ON&script=0&is_vtc=1&random=477380023&ipr=y p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	widget_iframe.69e02060c7c44baddf1b5629549acc0c.html platform.twitter.com/widgets/ Frame AD18	0 0	6ms 6ms	Document text/html	2606:2800:234:59:254c:406:2366:268c MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.69e02060c7c44baddf1b5629549acc0c.html?origin=https%3A%2F%2Fwww.tripwire.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40DA) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Thu, 02 Jan 2020 15:27:28 GMT Etag "4b563298f37eb3ef2a2f8897be83c714+gzip" Last-Modified Tue, 10 Dec 2019 23:44:55 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40DA) Vary Accept-Encoding X-Cache HIT Content-Length 5825
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72911&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&time=1577978848006 https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D72911%26url%3Dhttps%253A%252F%252Fwww.tripwire.com%252Fstate-of-security%252Ffeat... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72911&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&time=15779788480...	0 70 B	163ms 163ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LinkedIn Corporation
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72911&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&time=1577978848006&liSync=true Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip server Play vary Accept-Encoding x-li-fabric prod-lor1 status 200 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 20 x-li-uuid ehTg7mYb5hWwYPs1JCsAAA== Redirect headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff status 302 x-li-pop prod-tln1 content-length 20 x-li-uuid d+4W5WYb5hVAombkgSsAAA== pragma no-cache server Play x-frame-options sameorigin expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" vary Accept-Encoding strict-transport-security max-age=2592000 x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=72911&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&time=1577978848006&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	js Show response www.google-analytics.com/gtm/	61 KB 23 KB	20ms 20ms	Script application/javascript	2a00:1450:4001:814::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-PF5MM7D&t=gtm2&cid=1227953340.1577978848 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 1c9c19041ddc53c6d8e2b1040f064a6fa16a4730de623c6d4e80714fea66ae44 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding br last-modified Thu, 02 Jan 2020 15:00:00 GMT server Google Tag Manager access-control-allow-origin http://www.googletagmanager.com vary Accept-Encoding content-type application/javascript; charset=UTF-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control content-length 23347 x-xss-protection 0 expires Thu, 02 Jan 2020 15:27:28 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1499726495&t=pageview&_s=1&dl=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-a... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_gid=1604963552.1577978848&gjid=2085626784&_v=j79&z=405502620 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_v=j79&z=405502620 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_v=j79&z=405502620&slf_rd=1&random=1125331008	42 B 109 B	19ms 19ms	Image image/gif	2a00:1450:4001:824::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_v=j79&z=405502620&slf_rd=1&random=1125331008 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff server cafe timing-allow-origin * location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-1168187-1&cid=1227953340.1577978848&jid=1968655858&_v=j79&z=405502620&slf_rd=1&random=1125331008 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 cache-control no-cache, no-store, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 93 B	33ms 33ms	Image text/plain	2620:1ec:c11::200 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=26037517&Ver=2&mid=54c2f7a7-3599-1040-6a28-e51cbae9da93&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&p=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&r=&lt=3516&evt=pageLoad&msclkid=N&rn=454629 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 pragma no-cache date Thu, 02 Jan 2020 15:27:27 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: C4F1AD13E2F44C628A0048E66D6ADABE Ref B: FRAEDGE0820 Ref C: 2020-01-02T15:27:28Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	button.550007e6cc79c00bac51111d8131d860.js Show response platform.twitter.com/js/	7 KB 3 KB	6ms 6ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/js/button.550007e6cc79c00bac51111d8131d860.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40D0) / Resource Hash 04f4ae45c416f3cae99c9092537f549e56653297e79cea04501e0ebed1e9bd1c Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 02 Jan 2020 15:27:28 GMT Content-Encoding gzip Last-Modified Tue, 10 Dec 2019 23:44:46 GMT Server ECS (fcn/40D0) Etag "0c1c703295ecdf55c72e3a108ce862e8+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 X-Cache HIT Content-Type application/javascript; charset=utf-8 Content-Length 2294
GET H2	200	adsct t.co/i/	43 B 448 B	180ms 135ms	Image image/gif	104.244.42.197 Twitter Inc.
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1yrv&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0 Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER - Twitter Inc., US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff status 200, 200 OK x-twitter-response-tags BouncerCompliant strict-transport-security max-age=0 content-length 65 x-xss-protection 0 x-response-time 111 pragma no-cache last-modified Thu, 02 Jan 2020 15:27:28 GMT server tsa_o x-frame-options SAMEORIGIN content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash e884a07050cb4610ae5d5cc90f629989 x-transaction 0054063b000e2c7e expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/AW-1072044469/	2 KB 1 KB	43ms 42ms	Script text/javascript	2a00:1450:4001:815::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/AW-1072044469/?random=1577978848063&cv=9&fst=1577978848063&num=1&label=Phone%20Tracking&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc61&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&tiba=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash 6df8524fa9878a9f78ddf474e584d15636effbe908bec608d5418977df35a1fd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff content-type text/javascript; charset=UTF-8 server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1119 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/155/	9 KB 4 KB	31ms 31ms	Script application/x-javascript	95.101.176.176 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/155/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.176.176 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a95-101-176-176.deploy.static.akamaitechnologies.com Software Apache / Resource Hash efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 02 Jan 2020 15:27:28 GMT Content-Encoding gzip Last-Modified Fri, 30 Nov 2018 03:18:20 GMT Server Apache ETag "c67dad42946949112916578f78706df8:1543547900" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 3923 Expires Sat, 11 Apr 2020 15:27:28 GMT
GET H/1.1	200 OK	follow_button.69e02060c7c44baddf1b5629549acc0c.en.html platform.twitter.com/widgets/ Frame AF43	0 0	6ms 6ms	Document text/html	2606:2800:234:59:254c:406:2366:268c MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/follow_button.69e02060c7c44baddf1b5629549acc0c.en.html Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40D0) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Thu, 02 Jan 2020 15:27:28 GMT Etag "9b2093e7d0217523d2b68c3027b53723+gzip" Last-Modified Tue, 10 Dec 2019 23:44:47 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40D0) Vary Accept-Encoding X-Cache HIT Content-Length 13681
GET H/1.1	200 OK	follow_button.69e02060c7c44baddf1b5629549acc0c.en.html platform.twitter.com/widgets/ Frame A2A4	0 0	11ms 5ms	Document text/html	2606:2800:234:59:254c:406:2366:268c MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/follow_button.69e02060c7c44baddf1b5629549acc0c.en.html Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40D0) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Thu, 02 Jan 2020 15:27:28 GMT Etag "9b2093e7d0217523d2b68c3027b53723+gzip" Last-Modified Tue, 10 Dec 2019 23:44:47 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40D0) Vary Accept-Encoding X-Cache HIT Content-Length 13681
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1072044469/	2 KB 1 KB	23ms 22ms	Script text/javascript	2a00:1450:4001:815::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072044469/?random=1577978848076&cv=9&fst=1577978848076&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&tiba=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&hn=www.googleadservices.com&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash 548078fd3896b10225b8c0fe55c604bd3016034c624ad8f5e4a0673652a17002 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff content-type text/javascript; charset=UTF-8 server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1065 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	cse_element__en.js Show response www.google.com/cse/static/element/8b2252448421acb3/	257 KB 85 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/cse/static/element/8b2252448421acb3/cse_element__en.js?usqp=CAI%3D Requested by Host: cse.google.com URL: https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 02c39275000c1280f9cde808ebe731ec1924477305678759c1140ecaac49eba0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 14:57:12 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 31 Oct 2019 16:49:36 GMT server sffe age 1816 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 86820 x-xss-protection 0 expires Fri, 01 Jan 2021 14:57:12 GMT
GET H2	200	default+en.css www.google.com/cse/static/element/8b2252448421acb3/	40 KB 9 KB	84ms 84ms	Stylesheet text/css	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/cse/static/element/8b2252448421acb3/default+en.css Requested by Host: cse.google.com URL: https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 14:56:57 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 31 Oct 2019 16:49:36 GMT server sffe age 1831 vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9042 x-xss-protection 0 expires Fri, 01 Jan 2021 14:56:57 GMT
GET H2	200	default.css www.google.com/cse/static/style/look/v3/	11 KB 3 KB	83ms 83ms	Stylesheet text/css	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/cse/static/style/look/v3/default.css Requested by Host: cse.google.com URL: https://cse.google.com/cse/cse.js?cx=010691751587985000313:0qjxmbjwhqs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:18:23 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 21 Nov 2019 23:30:00 GMT server sffe age 545 vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=3000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2719 x-xss-protection 0 expires Thu, 02 Jan 2020 16:08:23 GMT
GET H/1.1	200 OK	visitWebPage Show response 314-iah-785.mktoresp.com/webevents/	2 B 303 B	818ms 168ms	XHR text/plain	192.28.147.68 MARKETO
General Check archive.org Show headers Download Go to Full URL https://314-iah-785.mktoresp.com/webevents/visitWebPage?_mchNc=1577978848103&_mchCn=&_mchId=314-IAH-785&_mchTk=_mch-tripwire.com-1577978848101-56510&_mchHo=www.tripwire.com&_mchPo=&_mchRu=%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/155/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN53580 (MARKETO - MARKETO, Inc., US), Reverse DNS Software akka-http/10.1.7 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Origin https://www.tripwire.com Response headers Access-Control-Allow-Origin * Date Thu, 02 Jan 2020 15:27:28 GMT Content-Encoding gzip Server akka-http/10.1.7 Transfer-Encoding chunked X-Request-Id 69b98857-a403-473d-98b3-5429a80c5e61 Content-Type text/plain; charset=UTF-8
GET H2	200	/ www.google.com/pagead/1p-user-list/1072044469/	42 B 113 B	95ms 95ms	Image image/gif	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1072044469/?random=1577978848076&cv=9&fst=1577977200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&tiba=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&fmt=3&is_vtc=1&random=626238029&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1072044469/	42 B 110 B	22ms 21ms	Image image/gif	2a00:1450:4001:824::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1072044469/?random=1577978848076&cv=9&fst=1577977200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&tiba=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&fmt=3&is_vtc=1&random=626238029&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/AW-1072044469/	42 B 113 B	84ms 84ms	Image image/gif	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/AW-1072044469/?random=1577978848063&cv=9&fst=1577977200000&num=1&label=Phone%20Tracking&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc61&sendb=1&frm=0&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&tiba=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&async=1&fmt=3&is_vtc=1&random=3767835314&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/AW-1072044469/	42 B 110 B	25ms 24ms	Image image/gif	2a00:1450:4001:824::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/AW-1072044469/?random=1577978848063&cv=9&fst=1577977200000&num=1&label=Phone%20Tracking&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc61&sendb=1&frm=0&url=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&tiba=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&async=1&fmt=3&is_vtc=1&random=3767835314&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.tripwire.com URL: https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 02 Jan 2020 15:27:28 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	jot.html platform.twitter.com/ Frame B09D Redirect Chain https://syndication.twitter.com/i/jot https://platform.twitter.com/jot.html	0 0	6ms 6ms	Document text/html	2606:2800:234:59:254c:406:2366:268c MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/jot.html Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40D0) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 Origin https://www.tripwire.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Thu, 02 Jan 2020 15:27:28 GMT Etag "d9592a6c704736fa4da218d4357976dd" Last-Modified Tue, 10 Dec 2019 23:46:10 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40D0) X-Cache HIT Content-Length 80 Redirect headers status 302 302 Found cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-length 0 content-type text/html;charset=utf-8 date Thu, 02 Jan 2020 15:27:28 GMT expires Tue, 31 Mar 1981 05:00:00 GMT last-modified Thu, 02 Jan 2020 15:27:28 GMT location https://platform.twitter.com/jot.html pragma no-cache server tsa_o strict-transport-security max-age=631138519 x-connection-hash 09e19000aa1f34280ef50eef4e9002c4 x-content-type-options nosniff x-frame-options SAMEORIGIN x-response-time 111 x-transaction 003ddaf20032a038 x-tsa-request-body-time 0 x-twitter-response-tags BouncerCompliant x-xss-protection 0
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 634 B	187ms 143ms	Script application/javascript	104.244.42.67 Twitter Inc.
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1yrv&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.67 , United States, ASN13414 (TWITTER - Twitter Inc., US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 02 Jan 2020 15:27:28 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200, 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 120 pragma no-cache last-modified Thu, 02 Jan 2020 15:27:28 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 0947992d818ada9f0b7e10dceb1e984a x-transaction 00d2d6a50040ab61 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	beacon.gif Show response rum-collector-2.pingdom.net/img/	0 213 B	140ms 35ms	XHR text/plain	34.251.112.144 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://rum-collector-2.pingdom.net/img/beacon.gif?id=591293a28a112bae944f0de6&sAW=1600&sAH=1200&bIW=1600&bIH=1200&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=14&cE=3132&dLE=14&dLS=1&fS=0&hS=3062&rE=-1&rS=-1&reS=3132&resS=3271&resE=3274&uEE=-1&uES=-1&dL=3273&dI=3511&dCLES=3511&dCLEE=3516&dC=4080&lES=4080&lEE=4083&s=nt&title=BadRabbit%20runs%20out%20of%20steam%20-%20but%20be%20prepared%20for%20the%20next%20ransomware%20attack&path=https%3A%2F%2Fwww.tripwire.com%2Fstate-of-security%2Ffeatured%2Fbadrabbit-runs-steam-prepared-next-ransomware-attack%2F&ref=&sId=e8dn5gaf&sST=1577978848&sIS=1&rV=0&v=1.4.0 Requested by Host: rum-static.pingdom.net URL: https://rum-static.pingdom.net/prum.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.251.112.144 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-251-112-144.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.tripwire.com/state-of-security/featured/badrabbit-runs-steam-prepared-next-ransomware-attack/ Origin https://www.tripwire.com Response headers Access-Control-Allow-Origin * Pragma no-cache Date Thu, 02 Jan 2020 15:27:28 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 0 Expires 0