URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Submission: On September 30 via api from CH

Summary

This website contacted 43 IPs in 7 countries across 36 domains to perform 110 HTTP transactions. The main IP is 35.169.17.140, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is www.armor.com.
TLS certificate: Issued by GlobalSign Extended Validation CA - S... on July 26th 2019. Valid for: a year.
This is the only time www.armor.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 27 35.169.17.140 14618 (AMAZON-AES)
1 23.111.9.35 33438 (HIGHWINDS2)
4 54.171.30.227 16509 (AMAZON-02)
12 2600:9000:214... 16509 (AMAZON-02)
3 13.32.158.25 16509 (AMAZON-02)
1 52.22.190.58 14618 (AMAZON-AES)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 151.101.12.157 54113 (FASTLY)
2 104.244.42.69 13414 (TWITTER)
1 104.111.251.133 16625 (AKAMAI-AS)
1 23.111.9.64 33438 (HIGHWINDS2)
1 192.229.221.91 15133 (EDGECAST)
2 178.249.101.23 11054 (LIVEPERSON)
2 34.194.209.108 14618 (AMAZON-AES)
1 192.28.147.68 53580 (MARKETO)
1 2a03:6400:10:... 11054 (LIVEPERSON)
4 208.89.12.87 11054 (LIVEPERSON)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a03:6400:10:... 11054 (LIVEPERSON)
1 2606:2800:234... 15133 (EDGECAST)
2 147.75.84.99 54825 (PACKET)
1 104.244.42.67 13414 (TWITTER)
3 93.184.220.178 15133 (EDGECAST)
2 2606:2800:234... 15133 (EDGECAST)
6 2a00:1450:400... 15169 (GOOGLE)
3 2a03:2880:f02... 32934 (FACEBOOK)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
2 143.204.214.90 16509 (AMAZON-02)
2 52.55.12.5 14618 (AMAZON-AES)
1 52.222.157.211 16509 (AMAZON-02)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 147.75.204.210 54825 (PACKET)
1 13.32.158.238 16509 (AMAZON-02)
2 2 52.30.46.130 16509 (AMAZON-02)
1 2 52.222.157.247 16509 (AMAZON-02)
1 216.58.210.2 15169 (GOOGLE)
1 147.75.83.123 54825 (PACKET)
2 2a03:2880:f12... 32934 (FACEBOOK)
1 1 104.244.42.200 13414 (TWITTER)
3 52.204.14.45 14618 (AMAZON-AES)
1 2600:9000:214... 16509 (AMAZON-02)
1 2 2620:119:50e1... 14413 (LINKEDIN)
1 1 2620:119:50e1... 14413 (LINKEDIN)
110 43
Apex Domain
Subdomains
Transfer
38 armor.com
www.armor.com
cdn.armor.com
720 KB
6 google-analytics.com
www.google-analytics.com
43 KB
6 liveperson.net
lptag.liveperson.net
va.v.liveperson.net
92 KB
6 salesloft.com
scout-cdn.salesloft.com
scout.salesloft.com
scout.us1.salesloft.com
5 KB
4 twitter.com
analytics.twitter.com
platform.twitter.com
syndication.twitter.com
950 B
4 hotjar.com
static.hotjar.com
script.hotjar.com
vars.hotjar.com
78 KB
4 trustarc.com
consent.trustarc.com
26 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
2 KB
3 company-target.com
api.company-target.com
segments.company-target.com
2 KB
3 facebook.net
connect.facebook.net
119 KB
3 bizible.com
cdn.bizible.com
1 KB
3 terminus.services
vidassets.terminus.services
3 KB
2 facebook.com
www.facebook.com
246 B
2 bidr.io
match.prod.bidr.io
752 B
2 google.de
www.google.de
302 B
2 engagio.com
web-analytics.engagio.com
1 KB
2 driftt.com
js.driftt.com
44 KB
2 bing.com
bat.bing.com
7 KB
2 gstatic.com
www.gstatic.com
13 KB
2 licdn.com
snap.licdn.com
6 KB
2 lpsnmedia.net
lpcdn.lpsnmedia.net Failed
accdn.lpsnmedia.net
2 KB
2 t.co
t.co
572 B
2 cloudfront.net
d1acp2n11z40zw.cloudfront.net
dn1f1hmdujj40.cloudfront.net
11 KB
1 googleadservices.com
www.googleadservices.com
573 B
1 google.com
www.google.com
180 B
1 doubleclick.net
stats.g.doubleclick.net
164 B
1 demandbase.com
tag.demandbase.com
15 KB
1 fonts.net
fast.fonts.net
152 B
1 googletagmanager.com
www.googletagmanager.com
33 KB
1 mktoresp.com
381-kpd-482.mktoresp.com
303 B
1 sociabble.com
cdn-public.sociabble.com
9 KB
1 marketo.net
munchkin.marketo.net
4 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 addtoany.com
static.addtoany.com
26 KB
1 glitch.me
simple-banner.glitch.me
210 B
1 fontawesome.com
use.fontawesome.com
14 KB
110 36
Domain Requested by
27 www.armor.com 1 redirects www.armor.com
11 cdn.armor.com www.armor.com
6 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.armor.com
4 va.v.liveperson.net lptag.liveperson.net
4 consent.trustarc.com www.armor.com
consent.trustarc.com
3 scout.us1.salesloft.com www.armor.com
3 connect.facebook.net www.armor.com
connect.facebook.net
3 cdn.bizible.com www.armor.com
3 vidassets.terminus.services www.armor.com
2 px.ads.linkedin.com 1 redirects
2 www.facebook.com www.armor.com
www.googletagmanager.com
2 segments.company-target.com 1 redirects www.armor.com
2 match.prod.bidr.io 2 redirects
2 www.google.de www.armor.com
www.gstatic.com
2 web-analytics.engagio.com www.armor.com
dn1f1hmdujj40.cloudfront.net
2 js.driftt.com www.armor.com
js.driftt.com
2 bat.bing.com www.armor.com
2 www.gstatic.com www.armor.com
www.gstatic.com
2 snap.licdn.com www.armor.com
snap.licdn.com
2 platform.twitter.com www.armor.com
2 static.hotjar.com www.armor.com
2 scout.salesloft.com scout-cdn.salesloft.com
2 lptag.liveperson.net www.armor.com
2 t.co www.armor.com
static.ads-twitter.com
1 www.linkedin.com 1 redirects
1 dn1f1hmdujj40.cloudfront.net web-analytics.engagio.com
1 syndication.twitter.com 1 redirects
1 vars.hotjar.com static.hotjar.com
1 www.googleadservices.com www.gstatic.com
1 api.company-target.com tag.demandbase.com
1 script.hotjar.com static.hotjar.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 tag.demandbase.com www.armor.com
1 analytics.twitter.com static.ads-twitter.com
1 fast.fonts.net www.armor.com
1 www.googletagmanager.com www.armor.com
1 accdn.lpsnmedia.net lptag.liveperson.net
1 lpcdn.lpsnmedia.net lptag.liveperson.net
www.armor.com
1 381-kpd-482.mktoresp.com munchkin.marketo.net
1 cdn-public.sociabble.com www.armor.com
1 scout-cdn.salesloft.com www.armor.com
1 munchkin.marketo.net www.armor.com
1 static.ads-twitter.com www.armor.com
1 static.addtoany.com www.armor.com
1 simple-banner.glitch.me www.armor.com
1 d1acp2n11z40zw.cloudfront.net www.armor.com
1 use.fontawesome.com www.armor.com
110 48
Subject Issuer Validity Valid
www.armor.com
GlobalSign Extended Validation CA - SHA256 - G3
2019-07-26 -
2020-09-15
a year crt.sh
*.fontawesome.com
DigiCert SHA2 Secure Server CA
2018-09-17 -
2019-11-21
a year crt.sh
*.trustarc.com
Go Daddy Secure Certificate Authority - G2
2017-07-18 -
2020-07-17
3 years crt.sh
cdn.armor.com
GlobalSign Domain Validation CA - SHA256 - G2
2019-04-09 -
2020-06-02
a year crt.sh
*.terminus.services
Amazon
2019-02-12 -
2020-03-12
a year crt.sh
*.cloudfront.net
DigiCert Global CA G2
2019-07-17 -
2020-07-05
a year crt.sh
glitch.com
Amazon
2019-01-20 -
2020-02-20
a year crt.sh
ssl472428.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-07-02 -
2020-01-08
6 months crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2019-08-14 -
2020-08-18
a year crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2018-12-24 -
2020-03-24
a year crt.sh
*.salesloft.com
COMODO RSA Domain Validation Secure Server CA
2017-08-25 -
2019-10-20
2 years crt.sh
sa377gl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA
2018-02-15 -
2020-06-04
2 years crt.sh
*.liveperson.net
COMODO RSA Organization Validation Secure Server CA
2017-12-17 -
2020-12-16
3 years crt.sh
salesloft.com
COMODO RSA Domain Validation Secure Server CA
2018-12-28 -
2020-02-04
a year crt.sh
*.mktoresp.com
GeoTrust RSA CA 2018
2018-02-05 -
2020-02-05
2 years crt.sh
*.lpsnmedia.net
COMODO RSA Organization Validation Secure Server CA
2018-02-26 -
2021-02-25
3 years crt.sh
*.v.liveperson.net
COMODO RSA Organization Validation Secure Server CA
2018-05-08 -
2020-05-07
2 years crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
s9.wac.edgecastcdn.net
DigiCert SHA2 Secure Server CA
2019-01-16 -
2021-02-03
2 years crt.sh
static.hotjar.com
Let's Encrypt Authority X3
2019-08-07 -
2019-11-05
3 months crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
cdn.bizible.com
Go Daddy Secure Certificate Authority - G2
2019-03-14 -
2021-04-13
2 years crt.sh
*.twimg.com
DigiCert SHA2 High Assurance Server CA
2018-11-19 -
2019-11-27
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-08-24 -
2019-10-19
2 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2019-04-01 -
2021-05-07
2 years crt.sh
*.google.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2
2019-04-30 -
2021-04-30
2 years crt.sh
drift.com
Amazon
2018-10-17 -
2019-11-17
a year crt.sh
*.engagio.com
COMODO RSA Organization Validation Secure Server CA
2017-05-23 -
2020-07-24
3 years crt.sh
*.demandbase.com
Go Daddy Secure Certificate Authority - G2
2018-09-20 -
2020-11-19
2 years crt.sh
www.google.de
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
script.hotjar.com
Let's Encrypt Authority X3
2019-08-07 -
2019-11-05
3 months crt.sh
*.company-target.com
Go Daddy Secure Certificate Authority - G2
2019-06-19 -
2021-08-18
2 years crt.sh
www.googleadservices.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
vars.hotjar.com
Let's Encrypt Authority X3
2019-08-07 -
2019-11-05
3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2019-05-29 -
2021-06-29
2 years crt.sh

This page contains 8 frames:

Primary Page: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Frame ID: F81EE91D2B7D0F69B8A4F323358F7CC8
Requests: 103 HTTP requests in this frame

Frame: https://lpcdn.lpsnmedia.net/le_secure_storage/3.8.0.0-release_461/storage.secure.min.html?loc=https%3A%2F%2Fwww.armor.com&site=76669337&env=prod
Frame ID: E2FF024C7CDE491FEAB6B83BD484EC60
Requests: 1 HTTP requests in this frame

Frame: https://lpcdn.lpsnmedia.net/le_secure_storage/3.8.0.0-release_461/storage.secure.min.html?loc=https%3A%2F%2Fwww.armor.com&site=76669337&env=prod
Frame ID: A5AD60FC4CC4939D1A1B23A15787B9BA
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.bed9e19e565ca3b578705de9e73c29ed.html?origin=https%3A%2F%2Fwww.armor.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Frame ID: 8DE0CA12308F5C5846F903D98D98F172
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-90f3a29ef7448451db5af955688970d7.html
Frame ID: 138B1E116317801D319E5ABA7A593619
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: D4B7B1095C34966B6E9F61BBB0C48A4E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: A613EDB2D8CB5B3AE1800E6EA51AEAF0
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: 5A30420D0E59055C1A97ED35FFDB4E69
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students HTTP 301
    https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • script /\/revslider\/[\/\w-]+\/js/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • script /\/revslider\/[\/\w-]+\/js/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • script /\/revslider\/[\/\w-]+\/js/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • script /addtoany\.com\/menu\/page\.js/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Overall confidence: 100%
Detected patterns
  • script /\/revslider\/[\/\w-]+\/js/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

110
Requests

99 %
HTTPS

40 %
IPv6

36
Domains

48
Subdomains

43
IPs

7
Countries

1277 kB
Transfer

4040 kB
Size

24
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students HTTP 301
    https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&gjid=1347098282&_gid=1993280749.1569849914&_u=YGBAgAADQ~&z=1453735772 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&_v=j79&z=1453735772 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&_v=j79&z=1453735772&slf_rd=1&random=1551675583
Request Chain 85
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAKark67JAQAABVzn-I0uw HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAKark67JAQAABVzn-I0uw&verifyHash=34abc1a9e3a8da784fd60ecbbca2bcbeca09440b
Request Chain 94
  • https://syndication.twitter.com/i/jot HTTP 302
  • https://platform.twitter.com/jot.html
Request Chain 101
  • https://px.ads.linkedin.com/collect/?time=1569849914578&pid=58768&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&fmt=js&s=1 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1569849914578%26pid%3D58768%26url%3Dhttps%253A%252F%252Fwww.armor.com%252Fthreat-intelligence%252Freading-writing-and-ransomware-new-attacks-greet-students%252F%26fmt%3Djs%26s%3D1%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1569849914578&pid=58768&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&fmt=js&s=1&liSync=true

110 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Redirect Chain
  • https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students
  • https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
108 KB
23 KB
Document
General
Full URL
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1b8765cc78882472ad251c587e2b236d280c4564b287d835c354637d7b9f2eba
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.armor.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Cookie
PHPSESSID=uo63qr910fuaact3gu4d576g84
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 30 Sep 2019 13:25:12 GMT
Link
<https://www.armor.com/wp-json/>; rel="https://api.w.org/" <https://www.armor.com/?p=23026>; rel=shortlink
Node
10.200.103.175
Server
nginx
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
X-TEC-API-ORIGIN
https://www.armor.com
X-TEC-API-ROOT
https://www.armor.com/wp-json/tribe/events/v1/
X-TEC-API-VERSION
v1
X-XSS-Protection
1; mode=block
transfer-encoding
chunked
Connection
keep-alive

Redirect headers

Cache-Control
no-cache, must-revalidate, max-age=0
Content-Type
text/html; charset=UTF-8
Date
Mon, 30 Sep 2019 13:25:11 GMT
Expires
Wed, 11 Jan 1984 05:00:00 GMT
Location
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Node
10.200.103.175
Server
nginx
Set-Cookie
PHPSESSID=uo63qr910fuaact3gu4d576g84; path=/
X-Frame-Options
SAMEORIGIN
X-Redirect-By
WordPress
X-XSS-Protection
1; mode=block
Content-Length
0
Connection
keep-alive
sb-instagram.min.css
www.armor.com/app/plugins/instagram-feed-pro/css/
51 KB
9 KB
Stylesheet
General
Full URL
https://www.armor.com/app/plugins/instagram-feed-pro/css/sb-instagram.min.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a1dad966d318bac62d305a0e05f1b047ed9575c9a7a086041ad24fa920cc6b7d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:12 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:13 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1c8d-cc5f"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Node
10.200.101.88
Connection
keep-alive
Content-Length
8717
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
reset.min.css
www.armor.com/app/plugins/the-events-calendar/common/src/resources/css/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.armor.com/app/plugins/the-events-calendar/common/src/resources/css/reset.min.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e96cfe81431ab0c70414bc65dd83d59ada01405419c8faca900637fdfffdd48b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Sep 2019 18:37:00 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8bb3cc-11bc"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Node
10.200.102.167
Connection
keep-alive
Content-Length
1094
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
common.min.css
www.armor.com/app/plugins/the-events-calendar/common/src/resources/css/
37 KB
6 KB
Stylesheet
General
Full URL
https://www.armor.com/app/plugins/the-events-calendar/common/src/resources/css/common.min.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
55c98973ad75643b7fa9abeb6f381973b66f764386538e8fd7e16b3f969d2f31
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Sep 2019 18:37:00 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8bb3cc-93f6"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Node
10.200.103.175
Connection
keep-alive
Content-Length
5885
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
tooltip.min.css
www.armor.com/app/plugins/the-events-calendar/common/src/resources/css/
2 KB
993 B
Stylesheet
General
Full URL
https://www.armor.com/app/plugins/the-events-calendar/common/src/resources/css/tooltip.min.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
34119901f74b4d927c3b3ac787f1b99819174e6308ad5d4cb05ba5409cb5ffa5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Sep 2019 18:37:00 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8bb3cc-663"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Node
10.200.101.88
Connection
keep-alive
Content-Length
579
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
style.min.css
www.armor.com/wp/wp-includes/css/dist/block-library/
29 KB
5 KB
Stylesheet
General
Full URL
https://www.armor.com/wp/wp-includes/css/dist/block-library/style.min.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Sep 2019 22:09:26 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d703616-726f"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.102.167
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
svgs-attachment.css
www.armor.com/app/mu-plugins/svg-support/css/
222 B
609 B
Stylesheet
General
Full URL
https://www.armor.com/app/mu-plugins/svg-support/css/svgs-attachment.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
756df835cdc3e6d51abfaa6f2cd0d48a3430e2bcc2c12566e06dc79f3ba4ff74
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Last-Modified
Wed, 18 Apr 2018 18:37:54 GMT
Server
nginx
ETag
"5ad79082-de"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
max-age=315360000
Node
10.200.103.175
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
222
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
simple-banner.css
www.armor.com/app/plugins/simple-banner/
315 B
612 B
Stylesheet
General
Full URL
https://www.armor.com/app/plugins/simple-banner/simple-banner.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
fda9e98004dfb48d2ef7a9c8a2532d83e7d70d246788f99ece81443e8a96db79
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Tue, 24 Apr 2018 03:54:02 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5adeaa5a-13b"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Node
10.200.102.59
Connection
keep-alive
Content-Length
198
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.js
www.armor.com/wp/wp-includes/js/jquery/
95 KB
34 KB
Script
General
Full URL
https://www.armor.com/wp/wp-includes/js/jquery/jquery.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Sep 2019 22:09:26 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d703616-17a69"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.102.167
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.themepunch.tools.min.js
www.armor.com/app/plugins/revslider/public/assets/js/
108 KB
38 KB
Script
General
Full URL
https://www.armor.com/app/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a1dff8b0c66227748951c4ff891f146f49c5a382ac8e3d6e3c2e9cf8aa560dc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:18 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1c92-1afe4"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.103.175
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.themepunch.revolution.min.js
www.armor.com/app/plugins/revslider/public/assets/js/
63 KB
18 KB
Script
General
Full URL
https://www.armor.com/app/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
27ead7f47a3fb4d1e7cbef0c68e28bde7ea18923cf41d8ca82ba13584eebc710
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:18 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1c92-fdb5"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.102.59
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
simple-banner.js
www.armor.com/app/plugins/simple-banner/
645 B
709 B
Script
General
Full URL
https://www.armor.com/app/plugins/simple-banner/simple-banner.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
794b7354ed6d515c822a9a56d49cb17c5a9368cf53981afcccf71ac46f2a3c74
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Sat, 08 Jun 2019 01:48:10 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5cfb13da-285"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.101.88
Connection
keep-alive
Content-Length
281
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
simple-banner-pro.js
www.armor.com/app/plugins/simple-banner/
307 B
661 B
Script
General
Full URL
https://www.armor.com/app/plugins/simple-banner/simple-banner-pro.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
04f6fe75ea746ef6eccc7e329feb9a6d010cb9223d984fb5492a3fb6d2d79709
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Sat, 08 Jun 2019 01:48:10 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5cfb13da-133"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.102.167
Connection
keep-alive
Content-Length
232
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
all.css
use.fontawesome.com/releases/v5.8.2/css/
54 KB
14 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:12 GMT
content-encoding
gzip
last-modified
Tue, 07 May 2019 16:50:11 GMT
server
NetDNA-cache/2.2
status
200
etag
W/"77cbad34e5ce95e70847b074e05faeab"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
style.css
www.armor.com/app/themes/armor-theme/
446 KB
62 KB
Stylesheet
General
Full URL
https://www.armor.com/app/themes/armor-theme/style.css
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e79e7268e259af85b71a208d363aed33c81e00e448cfeb7f26e2eb21b5672dd2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:57 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1cb9-6f72b"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.101.88
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
notice
consent.trustarc.com/
6 KB
3 KB
Script
General
Full URL
https://consent.trustarc.com/notice?domain=armor.com&c=teconsent&js=nj&noticeType=bb&text=true
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.30.227 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-30-227.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f9626465145ae204fe3ee258b24c9429041c9e134ceaf514803238605152a413
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
status
200
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache
vary
Accept-Encoding
content-length
2370
x-xss-protection
1; mode=block
expires
Mon, 30 Sep 2019 13:25:12 GMT
thumbnail-284f8349c6bb8236d88e20783145890e-compressor.png
cdn.armor.com/app/uploads/2017/09/
15 KB
15 KB
Image
General
Full URL
https://cdn.armor.com/app/uploads/2017/09/thumbnail-284f8349c6bb8236d88e20783145890e-compressor.png
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dca2a46c726b75d682229527df890e8ff2a8a63ed1b59a9f749335f6aa315724

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:03 GMT
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
last-modified
Sun, 29 Jul 2018 19:25:09 GMT
server
AmazonS3
age
135729
etag
"3777e1d3a246439c5ef9104ddb8af891"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
15209
x-amz-cf-id
bq7r82iT0XVVQ3UNP65TEBN8yhWIcuVJ5CRUSLp9kkMzbtDma7IfTA==
expires
Mon, 29 Jul 2019 19:25:08 GMT
Blog-Surge-Continuous-Compliance-tn.jpg
cdn.armor.com/app/uploads/2017/10/27223031/
11 KB
12 KB
Image
General
Full URL
https://cdn.armor.com/app/uploads/2017/10/27223031/Blog-Surge-Continuous-Compliance-tn.jpg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b5443203a86a9d8b802b2378c6458dffeb7f29ad991e105e69ca03bb74693e68

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
last-modified
Wed, 06 Jun 2018 19:10:39 GMT
server
AmazonS3
age
135730
etag
"c15e042abe8dbf883e4bdfbf5fe864fa"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
11745
x-amz-cf-id
s6-AZYX3lNbhhahdOVH8J96R-oTPARpJdD8XFUNVShNmH2EMQIzNMQ==
expires
Thu, 06 Jun 2019 19:10:38 GMT
2018-Q1-Social-Reports-HoneyPot-169x75.jpg
cdn.armor.com/app/uploads/2018/07/
3 KB
4 KB
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/07/2018-Q1-Social-Reports-HoneyPot-169x75.jpg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4ad5ac7ac169c38946be3696e837917de65d3f44f2c5ba250622ea7b478bc0a2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 27 Sep 2019 23:43:04 GMT
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
last-modified
Mon, 30 Jul 2018 04:06:49 GMT
server
AmazonS3
age
222129
etag
"2aa099bc88512ebd3add28bb06454041"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
3347
x-amz-cf-id
uJ266Xvw7fzNoF7KZZdNYNRCyumdY2iJW4Vt7JupbS3hNSiEYj7B3g==
expires
Tue, 30 Jul 2019 04:06:48 GMT
wp-emoji-release.min.js
www.armor.com/wp/wp-includes/js/
14 KB
5 KB
Script
General
Full URL
https://www.armor.com/wp/wp-includes/js/wp-emoji-release.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Sep 2019 22:09:26 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d703616-3610"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.102.59
Connection
keep-alive
Content-Length
4664
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
Armor_US-Ransomware-Attacks-8.29.19-1.jpg
cdn.armor.com/app/uploads/2019/08/
70 KB
70 KB
Image
General
Full URL
https://cdn.armor.com/app/uploads/2019/08/Armor_US-Ransomware-Attacks-8.29.19-1.jpg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6d8f15a09867ac073e71fee08dcc22f0ff9d96ad780f087b551330fb1644e2db

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 07:52:19 GMT
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
last-modified
Thu, 29 Aug 2019 19:48:05 GMT
server
AmazonS3
age
19975
etag
"90bbc0cfb8fee46c5181ba2f975bb281"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
71404
x-amz-cf-id
_qqsGVJm4O6djAI1-Edzwow8xrF4FOgbVeGUtMmSg_-CLzT8W3YmCg==
expires
Fri, 28 Aug 2020 19:48:04 GMT
t.js
vidassets.terminus.services/69451f1c-df25-43a7-ab03-b3258091e8b4/
3 KB
2 KB
Script
General
Full URL
https://vidassets.terminus.services/69451f1c-df25-43a7-ab03-b3258091e8b4/t.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.158.25 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-158-25.fra56.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
852d6ef7e1f541e29805a611f49b52f6ecb7a47679e966c9264db3c177234ba6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 27 Sep 2019 14:00:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2456
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Fri, 27 Sep 2019 12:54:41 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
via
1.1 fc3a4fa8a6bf80fc624a0bc082bb5b4e.cloudfront.net (CloudFront)
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
FRA56
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
-w4CvaM_Xmsc5eP-V3GQ_Q_H60IeamzUkQh35Eu3bE9w94xG_Or33Q==
facebook_icon.svg
cdn.armor.com/app/uploads/2018/04/27223106/
377 B
679 B
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/04/27223106/facebook_icon.svg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
42f08d3fd1152d7c7ae15257b5ff78097c45ee0aca2f76d2927a1115ebad9771

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
content-encoding
gzip
age
135730
x-cache
Hit from cloudfront
status
200
content-length
279
last-modified
Fri, 27 Apr 2018 22:31:07 GMT
server
AmazonS3
etag
"7fe7d2947610a338b7bacfb06339432d"
content-type
image/svg+xml
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
alN2LakSdzVlYigH6sS2QmJMXON7WUDE5l2StS8tgiKmJHd4fp36rw==
expires
Sat, 27 Apr 2019 22:31:06 GMT
twitter_icon.svg
cdn.armor.com/app/uploads/2018/03/27223106/
711 B
801 B
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/03/27223106/twitter_icon.svg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
86c47df0704a55ff8824483a2d32a37d567284baa4ba9ab7fb1658d9bc99cc02

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
content-encoding
gzip
age
135730
x-cache
Hit from cloudfront
status
200
content-length
402
last-modified
Fri, 27 Apr 2018 22:31:07 GMT
server
AmazonS3
etag
"a6fc975cdd56ef4feadaf1290159de9c"
content-type
image/svg+xml
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
2AaAAKJMlJmK6w0bzcTH5eWO4CetK-Gd1_VAz1P1sO0-E7vj1vj5Fg==
expires
Sat, 27 Apr 2019 22:31:06 GMT
linkedin_icon.svg
cdn.armor.com/app/uploads/2018/04/27223106/
610 B
770 B
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/04/27223106/linkedin_icon.svg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1e6f7b22b807f132cd56bd7f8d8d19f6555eb47ef10770812c8b9525e2608fe0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
content-encoding
gzip
age
135730
x-cache
Hit from cloudfront
status
200
content-length
369
last-modified
Fri, 27 Apr 2018 22:31:07 GMT
server
AmazonS3
etag
"eb688f911bae89c79d516788ec5e381c"
content-type
image/svg+xml
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
eU1jw8hgMJ0aK3pHUXnxZmCqw_ElUTwKX_9jxMB4nzpThFh8-dQ_xg==
expires
Sat, 27 Apr 2019 22:31:06 GMT
instagram_icon.svg
cdn.armor.com/app/uploads/2018/08/
2 KB
1 KB
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/08/instagram_icon.svg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
079b03a5c4fac8e8f958095e9954f8072cde83d6eef64f01ea73c3c7e47f382c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
content-encoding
gzip
age
135730
x-cache
Hit from cloudfront
status
200
content-length
1001
last-modified
Wed, 29 Aug 2018 21:47:04 GMT
server
AmazonS3
etag
"25a388fe1964cf513760a2ac78a3a422"
content-type
image/svg+xml
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
AleqSJ-Nh8iy2rgBxKdgIliUULrl1lILFihUC9aQsHIFFxgFGv68Uw==
expires
Thu, 29 Aug 2019 21:47:03 GMT
youtube_icon.svg
cdn.armor.com/app/uploads/2018/04/27223106/
669 B
774 B
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/04/27223106/youtube_icon.svg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
04214d71c2c8c35d5404fbb0f096cb7c3bf17a1dfaf10587a7716de9dc0071a5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
content-encoding
gzip
age
135730
x-cache
Hit from cloudfront
status
200
content-length
373
last-modified
Fri, 27 Apr 2018 22:31:07 GMT
server
AmazonS3
etag
"4da716d9936b11c52a21d9930293ba22"
content-type
image/svg+xml
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
FEh5gpEQUIbGJsQKMTxcgRp6TWqfhNSNaj9r1X-ShqnH5qyAzH2nIg==
expires
Sat, 27 Apr 2019 22:31:06 GMT
slideshare_icon.svg
cdn.armor.com/app/uploads/2018/04/27223105/
859 B
884 B
Image
General
Full URL
https://cdn.armor.com/app/uploads/2018/04/27223105/slideshare_icon.svg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
596107120d4e37fdd432fd77b9a35ed8cd715d8f0d8143c579c57d3e58282c57

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
content-encoding
gzip
age
135730
x-cache
Hit from cloudfront
status
200
content-length
484
last-modified
Fri, 27 Apr 2018 22:31:06 GMT
server
AmazonS3
etag
"fb72b3ef76e69c5ccd015303a75341b1"
content-type
image/svg+xml
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
y_MmvVkm7fJcMxh-J0mBexMFZ3yBA2sH_9kR2-lX8z5g4Lpa5RbO3w==
expires
Sat, 27 Apr 2019 22:31:05 GMT
Armor_Logo_Orange_Tagline.png
d1acp2n11z40zw.cloudfront.net/app/uploads/2017/04/27223043/
3 KB
3 KB
Image
General
Full URL
https://d1acp2n11z40zw.cloudfront.net/app/uploads/2017/04/27223043/Armor_Logo_Orange_Tagline.png
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
27f1894b4c226d8d37278433ff3dd2e448cb877d2cbe818d189fc905195d3422

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 28 Sep 2019 23:43:04 GMT
via
1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
last-modified
Wed, 06 Jun 2018 19:13:58 GMT
server
AmazonS3
age
135730
etag
"355e8922acf206ac858e8a095170671b"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
3183
x-amz-cf-id
qSWdTUhXcwe5HRTjhs9NYUoQzsRQKbCxA1D77spIHSk4zL-YwuHKCw==
expires
Thu, 06 Jun 2019 19:13:57 GMT
tribe-common.min.js
www.armor.com/app/plugins/the-events-calendar/common/src/resources/js/
321 B
587 B
Script
General
Full URL
https://www.armor.com/app/plugins/the-events-calendar/common/src/resources/js/tribe-common.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf7a610c11489bfce177c3c71c5c7aec7101b1ba754d3d2aacc9636fc046c3b6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Sep 2019 18:37:00 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8bb3cc-141"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.101.88
Connection
keep-alive
Content-Length
159
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
tooltip.min.js
www.armor.com/app/plugins/the-events-calendar/common/src/resources/js/
523 B
692 B
Script
General
Full URL
https://www.armor.com/app/plugins/the-events-calendar/common/src/resources/js/tooltip.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
64c85e8b3d558b7ced2ce4d184dafd88b8dda0cfb0f388a06a7ff3e8f34841d8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Sep 2019 18:37:00 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8bb3cc-20b"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.102.167
Connection
keep-alive
Content-Length
263
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery-migrate.min.js
www.armor.com/wp/wp-includes/js/jquery/
10 KB
4 KB
Script
General
Full URL
https://www.armor.com/wp/wp-includes/js/jquery/jquery-migrate.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Sep 2019 22:09:26 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d703616-2748"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.103.175
Connection
keep-alive
Content-Length
4016
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
armor-header.js
www.armor.com/app/themes/armor-theme/js/dist/
168 KB
58 KB
Script
General
Full URL
https://www.armor.com/app/themes/armor-theme/js/dist/armor-header.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
d8e3d639b5446534fbec951b583b6eb37962a4e82fd4c6c1ff6ca3534de3eb0d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:20 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1c94-2a02c"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.101.88
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
demo-fw.js
www.armor.com/app/themes/armor-theme/js/scripts/
4 KB
2 KB
Script
General
Full URL
https://www.armor.com/app/themes/armor-theme/js/scripts/demo-fw.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
958bb1007d69f98adfd7f7966d348275f35329d7c23d91d6fb7d660d04afdb8f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:20 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1c94-10ce"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.102.167
Connection
keep-alive
Content-Length
1185
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
armor-footer.js
www.armor.com/app/themes/armor-theme/js/dist/
738 KB
221 KB
Script
General
Full URL
https://www.armor.com/app/themes/armor-theme/js/dist/armor-footer.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
24bdf22b6e237ff6f00bdb08bfd0b80f50dd9dbedaba96880c2de544082e1c30
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Sep 2019 20:16:20 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d8d1c94-b8670"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
transfer-encoding
chunked
Node
10.200.103.175
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
wp-embed.min.js
www.armor.com/wp/wp-includes/js/
1 KB
1 KB
Script
General
Full URL
https://www.armor.com/wp/wp-includes/js/wp-embed.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Sep 2019 22:09:26 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"5d703616-57b"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Node
10.200.101.88
Connection
keep-alive
Content-Length
753
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
hostname
simple-banner.glitch.me/
2 B
210 B
XHR
General
Full URL
https://simple-banner.glitch.me/hostname
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/plugins/simple-banner/simple-banner-pro.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.190.58 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-22-190-58.compute-1.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-powered-by
Express
status
200
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
2
page.js
static.addtoany.com/menu/
79 KB
26 KB
Script
General
Full URL
https://static.addtoany.com/menu/page.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:6e27 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc71dde0fa1f3434b18e014866b9484f577bc34c8ea80155e0039fe041419fa6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
via
e5s
x-content-type-options
nosniff
cf-cache-status
HIT
age
111418
p3p
CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
status
200
content-encoding
br
vary
Accept-Encoding
last-modified
Wed, 22 May 2019 06:26:38 GMT
server
cloudflare
etag
W/"13c2c-589740c42abc9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
expires
Wed, 02 Oct 2019 13:25:13 GMT
cache-control
public, max-age=172800
cf-ray
51e685874f7ecb9c-VIE
cf-bgj
minify
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
age
18717
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-fra19175-FRA
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1569849913.459822,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
sbi-sprite.png
www.armor.com/app/plugins/instagram-feed-pro/img/
4 KB
4 KB
Image
General
Full URL
https://www.armor.com/app/plugins/instagram-feed-pro/img/sbi-sprite.png
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
9de999e7d4aa267a5acee4a0aed70ae6df10838613e9627a97a63cf47feb173e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/app/plugins/instagram-feed-pro/css/sb-instagram.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Last-Modified
Thu, 26 Sep 2019 20:16:13 GMT
Server
nginx
ETag
"5d8d1c8d-f67"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=315360000
Node
10.200.101.88
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3943
X-XSS-Protection
1; mode=block
Expires
Thu, 31 Dec 2037 23:55:55 GMT
de1216be-00c2-43c0-9c45-3e7f925eb519.woff2
www.armor.com/app/themes/armor-theme/Fonts/
25 KB
25 KB
Font
General
Full URL
https://www.armor.com/app/themes/armor-theme/Fonts/de1216be-00c2-43c0-9c45-3e7f925eb519.woff2
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
c2944cd18afec08747955222976eba2eea19258b6e2ede5bb11d8cb106647e4c

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Last-Modified
Thu, 26 Sep 2019 20:16:19 GMT
Server
nginx
ETag
"5d8d1c93-62ec"
Content-Type
application/octet-stream
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
25324
121784c1-863c-4e49-b682-625ea7de55b0.woff2
www.armor.com/app/themes/armor-theme/Fonts/
26 KB
26 KB
Font
General
Full URL
https://www.armor.com/app/themes/armor-theme/Fonts/121784c1-863c-4e49-b682-625ea7de55b0.woff2
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4ca6b213241815a702f4bcc48945ea383cb8b32ef60547bdb4436b4b6cab420a

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Last-Modified
Thu, 26 Sep 2019 20:16:19 GMT
Server
nginx
ETag
"5d8d1c93-6654"
Content-Type
application/octet-stream
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
26196
44e7b0fa-6c8d-43c2-b19e-f1e3ce9ea57c.woff2
www.armor.com/app/themes/armor-theme/Fonts/
24 KB
25 KB
Font
General
Full URL
https://www.armor.com/app/themes/armor-theme/Fonts/44e7b0fa-6c8d-43c2-b19e-f1e3ce9ea57c.woff2
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.17.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-17-140.compute-1.amazonaws.com
Software
nginx /
Resource Hash
606aeba72580863b6f94f94a6b9d4bda72f17ff65e4adb951356d2a7f545707e

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Last-Modified
Thu, 26 Sep 2019 20:16:19 GMT
Server
nginx
ETag
"5d8d1c93-619c"
Content-Type
application/octet-stream
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
24988
v1.7-11
consent.trustarc.com/asset/notice.js/v/
55 KB
19 KB
Script
General
Full URL
https://consent.trustarc.com/asset/notice.js/v/v1.7-11
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=armor.com&c=teconsent&js=nj&noticeType=bb&text=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.30.227 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-30-227.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a451f2564c4d093f17562cec045ad8d57dc5ff438a1b7f5831a958e69c962e58
Security Headers
Name Value
X-Frame-Options ALLOWALL

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
public
date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
vary
Accept-Encoding
last-modified
Thu, 5 Sep 2019 04:10:58 GMT
server
nginx
status
200
x-frame-options
ALLOWALL
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=2592000
expires
Wed, 30 Oct 2019 13:25:13 GMT
2018-Q4-Website-HeaderImage-Book.jpg
cdn.armor.com/app/uploads/2019/01/
41 KB
41 KB
Image
General
Full URL
https://cdn.armor.com/app/uploads/2019/01/2018-Q4-Website-HeaderImage-Book.jpg
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:ba00:1a:86d5:4300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
159dff3bd530baa20e57738b0d8c87e8b3e38d8d58ba6ef85784f0e6fd6e02e2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 29 Sep 2019 18:32:32 GMT
via
1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
last-modified
Wed, 02 Jan 2019 16:53:08 GMT
server
AmazonS3
age
67961
etag
"5a97f849d87011094d524137adfd4681"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
41552
x-amz-cf-id
KM4ZLzOhTFd3lh_Ia2gCzI0nJZ4a18FpP-ooSTq8W1hgLW7B5NzP1Q==
expires
Thu, 02 Jan 2020 16:53:07 GMT
t.gif
vidassets.terminus.services/69451f1c-df25-43a7-ab03-b3258091e8b4/
42 B
689 B
Image
General
Full URL
https://vidassets.terminus.services/69451f1c-df25-43a7-ab03-b3258091e8b4/t.gif?d=66e7dd77-aaf0-4799-8257-b55580415bbf&s=babfd8ee-2188-4495-90e0-290594637b44&cb=1569849913500
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.158.25 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-158-25.fra56.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 27 Sep 2019 14:41:13 GMT
via
1.1 fc3a4fa8a6bf80fc624a0bc082bb5b4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
2456
x-cache
Hit from cloudfront
status
200
content-length
42
last-modified
Fri, 27 Sep 2019 12:54:41 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
FRA56
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
763BjBYT2XGKQdnwKqMAecQodvvJs6iOaVCqZarPZihd_5y0ckX5iw==
adsct
t.co/i/
43 B
448 B
Image
General
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvzk1&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
116
pragma
no-cache
last-modified
Mon, 30 Sep 2019 13:25:13 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
ba6d4fbf95b3bafef53e785795b2bccc
x-transaction
00d1f63b003de20a
expires
Tue, 31 Mar 1981 05:00:00 GMT
notice
consent.trustarc.com/
11 KB
4 KB
Script
General
Full URL
https://consent.trustarc.com/notice?domain=armor.com&country=de&js=nj2&c=teconsent&noticeType=bb&text=true
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=armor.com&c=teconsent&js=nj&noticeType=bb&text=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.30.227 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-30-227.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6301fb61e4d37e04e0957e1f5063311f2b3d10c4935f6ce9783b276302b4a650
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Origin
https://www.armor.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
status
200
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache
vary
Accept-Encoding
content-length
3587
x-xss-protection
1; mode=block
expires
Mon, 30 Sep 2019 13:25:12 GMT
munchkin.js
munchkin.marketo.net/151/
8 KB
4 KB
Script
General
Full URL
https://munchkin.marketo.net/151/munchkin.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-header.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-251-133.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
585107ada7f42329cd4d6ab1d1e87fdf26f4994e8f47d72a44ee8ab5bd291288

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Aug 2015 02:19:08 GMT
Server
Apache
ETag
"bd3daad4a1e88a1196d76b6dd3c9deed:1440037148"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
3503
Expires
Wed, 08 Jan 2020 13:25:13 GMT
sl.js
scout-cdn.salesloft.com/
6 KB
3 KB
Script
General
Full URL
https://scout-cdn.salesloft.com/sl.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-header.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.64 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
91f45811a83ee1bd3005eb6df52ef0bf69c1ee66ce0a3b812bc1fbca392473ee

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
last-modified
Mon, 07 Jan 2019 19:21:23 GMT
server
NetDNA-cache/2.2
x-amz-request-id
4B12F163F21C8305
etag
W/"5ae62e3d1adb9aa509b61aed2f35d9d2"
x-cache
HIT
content-type
application/javascript
status
200
x-amz-id-2
BDIZrtvzP70fRgQQa2RckpLutYH3h2Ri8eEClb+LrYSXlxCqPCv2GDoq6/JIChsw93pqL5vPNgI=
track.min.js
cdn-public.sociabble.com/blob/js/leadgen/
21 KB
9 KB
Script
General
Full URL
https://cdn-public.sociabble.com/blob/js/leadgen/track.min.js?v=1.5
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-header.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.91 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FF2) / ASP.NET
Resource Hash
345a4178b63432c1976d4d5601c44822394e6caddcfbac6d54e26f5e1438c401

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
x-powered-by
ASP.NET
x-cache
HIT
status
200
content-length
8834
last-modified
Tue, 16 Jul 2019 20:09:17 GMT
server
ECAcc (frc/8FF2)
etag
"1c8fb58123cd51:0"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=300
accept-ranges
bytes
access-control-allow-headers
*
expires
Mon, 30 Sep 2019 13:30:13 GMT
tag.js
lptag.liveperson.net/tag/
18 KB
7 KB
Script
General
Full URL
https://lptag.liveperson.net/tag/tag.js?site=76669337
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-header.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
ws /
Resource Hash
cc490a8ef7deb4c7fba66f332ad8cdd39433675b95d2bd341300ab7b718f8e4e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
last-modified
Tue, 21 Aug 2018 07:47:45 GMT
server
ws
etag
"5b7bc3a1-198d"
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
status
200
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
public, max-age=630
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length
6541
adsct
t.co/i/
43 B
124 B
Image
General
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvzk1&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
115
pragma
no-cache
last-modified
Mon, 30 Sep 2019 13:25:13 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
ba6d4fbf95b3bafef53e785795b2bccc
x-transaction
00ea840600bc29e6
expires
Tue, 31 Mar 1981 05:00:00 GMT
r
scout.salesloft.com/
41 B
432 B
XHR
General
Full URL
https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0Ijo5NDMxfQ.dr7gyFx8D1WAY1Fympf6QhebZ8MqN38xN6fqjM5fblw
Requested by
Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.194.209.108 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-194-209-108.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
e05ae076790852a21a47535d8a06e4ebdfc3079536d9c3f9f91d9f5b29303f0e

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
server
Cowboy
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.armor.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
41
x-request-id
2n4jkbfcta34cbr6h9eum4f4
.jsonp
lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/
225 KB
82 KB
Script
General
Full URL
https://lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-header.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
ws /
Resource Hash
3cd2823fbccb853a60fb14fa44f6118508032ae545648c68960faa9b9a9880ac

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
server
ws
x-cache-status
EXPIRED
access-control-allow-methods
GET, POST, PATCH
content-type
application/x-javascript
status
200
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
public, max-age=630
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
visitWebPage
381-kpd-482.mktoresp.com/webevents/
2 B
303 B
XHR
General
Full URL
https://381-kpd-482.mktoresp.com/webevents/visitWebPage?_mchNc=1569849913777&_mchCn=&_mchId=381-KPD-482&_mchTk=_mch-armor.com-1569849913777-61499&_mchHo=www.armor.com&_mchPo=&_mchRu=%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&_mchPc=https%3A&_mchVr=151&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/151/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.147.68 , United States, ASN53580 (MARKETO - MARKETO, Inc., US),
Reverse DNS
Software
akka-http/10.1.7 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 30 Sep 2019 13:25:14 GMT
Content-Encoding
gzip
Server
akka-http/10.1.7
Transfer-Encoding
chunked
X-Request-Id
b6ac8559-01d3-411f-ace4-f3f3b3e47b2f
Content-Type
text/plain; charset=UTF-8
storage.secure.min.html
lpcdn.lpsnmedia.net/le_secure_storage/3.8.0.0-release_461/ Frame E2FF
0
0

zones
accdn.lpsnmedia.net/api/account/76669337/configuration/le-campaigns/
17 KB
2 KB
Script
General
Full URL
https://accdn.lpsnmedia.net/api/account/76669337/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a03:6400:10:0:178:249:97:99 , United Kingdom, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
ws /
Resource Hash
362945725cbb0177031a8405e7553bad5f4cb196870d0f69e7e0800c9f5c38e5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
server
ws
x-cache-status
EXPIRED
vary
Accept
content-type
application/javascript
status
200
expires
Mon, 30 Sep 2019 13:26:13 GMT
76669337
va.v.liveperson.net/api/js/
233 B
1 KB
Script
General
Full URL
https://va.v.liveperson.net/api/js/76669337?&cb=lpCb68305x79827&t=sp&ts=1569849913793&pid=3721661799&tid=3483559582&pt=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&u=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&df=0&os=1
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
3f5c810eed78ba4b258674546b5576ad4e2a10ded140d25205631a8763ea4167

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/json
status
200
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
gtm.js
www.googletagmanager.com/
134 KB
33 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WJX6LN3
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-footer.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ad547fb00dd0ab5dcb0eb6da78dd1958de5ea07130c4a660a277b712ebda02ac
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
br
last-modified
Mon, 30 Sep 2019 12:00:00 GMT
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
33784
x-xss-protection
0
expires
Mon, 30 Sep 2019 13:25:13 GMT
storage.secure.min.html
lpcdn.lpsnmedia.net/le_secure_storage/3.8.0.0-release_461/ Frame A5AD
0
0
Document
General
Full URL
https://lpcdn.lpsnmedia.net/le_secure_storage/3.8.0.0-release_461/storage.secure.min.html?loc=https%3A%2F%2Fwww.armor.com&site=76669337&env=prod
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-footer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a03:6400:10:0:178:249:97:98 , United Kingdom, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
ws /
Resource Hash

Request headers

:method
GET
:authority
lpcdn.lpsnmedia.net
:scheme
https
:path
/le_secure_storage/3.8.0.0-release_461/storage.secure.min.html?loc=https%3A%2F%2Fwww.armor.com&site=76669337&env=prod
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/

Response headers

status
200
date
Mon, 30 Sep 2019 13:25:13 GMT
content-type
text/html
last-modified
Tue, 10 Sep 2019 15:26:02 GMT
content-encoding
gzip
server
ws
vary
Origin
access-control-allow-methods
GET, POST, PATCH
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
expires
Mon, 30 Sep 2019 13:35:13 GMT
cache-control
max-age=600
1.css
fast.fonts.net/t/
0
152 B
Stylesheet
General
Full URL
https://fast.fonts.net/t/1.css?apiType=css&projectid=undefined
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AE) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
last-modified
Wed, 21 Feb 2018 12:55:22 GMT
server
ECS (fcn/41AE)
etag
"616070693"
status
200
x-cache
HIT
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=0
accept-ranges
bytes
content-length
0
expires
Mon, 30 Sep 2019 13:25:13 GMT
hotjar-620868.js
static.hotjar.com/c/
15 KB
3 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-620868.js?sv=6
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.84.99 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
Software
openresty /
Resource Hash
18bc19ed74bee962fa99f71813ef5d290cb481e211cce34e9c7279f04a808f74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
section-io-tag
hotjar
age
0
status
200
section-io-cache
Miss
vary
Accept-Encoding
content-length
2857
server
openresty
cache-control
max-age=60
x-frame-options
SAMEORIGIN
etag
W/e5d548dca998b3897eeb512e4fa63e91
access-control-max-age
600
section-io-origin-status
304
access-control-allow-origin
*
x-cache-hit
1
section-io-origin-time-seconds
0.086
section-io-id
a98337608fe163a9901b1bc5a4e105aa
accept-ranges
bytes
content-type
application/javascript
t.gif
vidassets.terminus.services/69451f1c-df25-43a7-ab03-b3258091e8b4/
42 B
688 B
Image
General
Full URL
https://vidassets.terminus.services/69451f1c-df25-43a7-ab03-b3258091e8b4/t.gif?d=66e7dd77-aaf0-4799-8257-b55580415bbf&s=babfd8ee-2188-4495-90e0-290594637b44&cb=1569849913899
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.158.25 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-158-25.fra56.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 27 Sep 2019 14:41:13 GMT
via
1.1 fc3a4fa8a6bf80fc624a0bc082bb5b4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
2456
x-cache
Hit from cloudfront
status
200
content-length
42
last-modified
Fri, 27 Sep 2019 12:54:41 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
FRA56
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
HSO1S13TZjWhsw3i6PT2xSQf9Zipycav2fzU_9F3WeGsv6-eFoUC8Q==
adsct
analytics.twitter.com/i/
31 B
634 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvzk1&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
112
pragma
no-cache
last-modified
Mon, 30 Sep 2019 13:25:13 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
64e1293f3abb081a0c847f150bdac079
x-transaction
000fd308000e4ae8
expires
Tue, 31 Mar 1981 05:00:00 GMT
bannermsg
consent.trustarc.com/
43 B
277 B
Image
General
Full URL
https://consent.trustarc.com/bannermsg?action=views&domain=armor.com&behavior=implied&country=de&language=en&rand=0.41517000992164843
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.30.227 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-30-227.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 30 Sep 2019 13:25:13 GMT
x-content-type-options
nosniff
server
nginx
status
200
x-frame-options
SAMEORIGIN
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
content-length
43
x-xss-protection
1; mode=block
expires
Mon, 30 Sep 2019 13:25:12 GMT
ipv
cdn.bizible.com/m/
43 B
380 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=57adaa143fdd4edd8e879a414bb4662c&_biz_s=3cd5a5&_biz_l=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&_biz_t=1569849913828&_biz_i=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&_biz_n=0&rnd=64974&cdn_o=a&_biz_z=1569849913915
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A2) / ASP.NET
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 30 Sep 2019 13:25:13 GMT
x-aspnetmvc-version
5.2
last-modified
Sat, 28 Sep 2019 17:56:39 GMT
server
ECS (fcn/41A2)
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
widget_iframe.bed9e19e565ca3b578705de9e73c29ed.html
platform.twitter.com/widgets/ Frame 8DE0
0
0
Document
General
Full URL
https://platform.twitter.com/widgets/widget_iframe.bed9e19e565ca3b578705de9e73c29ed.html?origin=https%3A%2F%2Fwww.armor.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-footer.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419F) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Mon, 30 Sep 2019 13:25:13 GMT
Etag
"6f4bb4155518386526ca164541e6b1ce+gzip"
Last-Modified
Thu, 28 Jun 2018 18:19:06 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/419F)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
5868
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJX6LN3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
3555
date
Mon, 30 Sep 2019 12:25:58 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Mon, 30 Sep 2019 14:25:58 GMT
fbevents.js
connect.facebook.net/en_US/
121 KB
31 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
31604
x-xss-protection
0
pragma
public
x-fb-debug
/uMUNJEo7pTsg8GVDtJKUymhsCYl8D+XQDJVUAcg6W5lavokKLAuyy5jwVpraMxW41bN5ecXnbAb9y6p/33sJg==
x-fb-trip-id
420120009
x-frame-options
DENY
date
Mon, 30 Sep 2019 13:25:13 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
hotjar-548479.js
static.hotjar.com/c/
3 KB
2 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-548479.js?sv=5
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.84.99 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
Software
openresty /
Resource Hash
2fb2b3c269ca19ba745baa2009ae65de9762077a94d97ffb30b647aae435e328
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
section-io-tag
hotjar
age
277
status
200
section-io-cache
Hit
vary
Accept-Encoding
content-length
1572
server
openresty
cache-control
max-age=60
x-frame-options
SAMEORIGIN
etag
W/f5ada9c797f9299510d938351ff92a73
access-control-max-age
600
section-io-origin-status
304
access-control-allow-origin
*
x-cache-hit
1
section-io-origin-time-seconds
0.076
section-io-id
d559692890f2163884b82974ee306dd4
accept-ranges
bytes
content-type
application/javascript
insight.min.js
snap.licdn.com/li.lms-analytics/
944 B
753 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
03f71f7cf4b7044d55aa17f413b7b312d2fe87c21032f0d31a08adce9f54f674

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:13 GMT
Content-Encoding
gzip
Last-Modified
Fri, 27 Sep 2019 16:37:00 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=72085
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
440
loader.js
www.gstatic.com/wcm/
599 B
704 B
Script
General
Full URL
https://www.gstatic.com/wcm/loader.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
e7d6ff44c58978483c195976a872481f5f7e3dad18d3c1d735a6f227b388768a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 12:57:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 25 Sep 2019 19:45:00 GMT
server
sffe
age
1685
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
420
x-xss-protection
0
expires
Mon, 30 Sep 2019 13:57:08 GMT
bat.js
bat.bing.com/
23 KB
7 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 18:57:28 GMT
x-msedge-ref
Ref A: 820160B33E5A442BAB30B135AFCE7A2B Ref B: VIEEDGE1319 Ref C: 2019-09-30T13:25:13Z
status
200
etag
"09c5197968d51:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7148
dfiidzdnakp5.js
js.driftt.com/include/1569850200000/
132 KB
44 KB
Script
General
Full URL
https://js.driftt.com/include/1569850200000/dfiidzdnakp5.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.90 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-90.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
8bfc10f52a88db2b9548f9cc4dbc460b0570b6f795e84b0f4e429c421ea2b03d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
status
200
access-control-allow-origin
*
last-modified
Wed, 25 Sep 2019 17:06:50 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 78c402b74e65ae12b398b6b957ab229e.cloudfront.net (CloudFront)
cache-control
max-age=10
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zosJZavXtENtMbRcuvmjjtJjamKO-343JG5yoMtFVit_Q6LAaY54TQ==
ei.js
web-analytics.engagio.com/js/
1 KB
1 KB
Script
General
Full URL
https://web-analytics.engagio.com/js/ei.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.55.12.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-55-12-5.compute-1.amazonaws.com
Software
/
Resource Hash
ac3eabbaf8163e35b29458577bf04ff6d9e254b69dab0130d242edf69d29b8ec

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 30 Sep 2019 13:25:14 GMT
cache-control
max-age=0
last-modified
Thu, 26 Sep 2019 21:45:53 GMT
content-length
1077
vary
Origin
content-type
application/javascript; charset=utf-8
a9777159.min.js
tag.demandbase.com/
56 KB
15 KB
Script
General
Full URL
https://tag.demandbase.com/a9777159.min.js
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.157.211 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-157-211.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f944c3a1f60283099f5ed2983bbd16132f41d272a7c433435fa658e08e5a8aa1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 20 Sep 2019 18:28:19 GMT
content-encoding
gzip
last-modified
Tue, 20 Aug 2019 00:29:57 GMT
server
AmazonS3
age
2455
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
Z.KEoHWPp2yzjLti1hsN45KfksJC7TSF
status
200
cache-control
public, max-age=3600
x-amz-cf-pop
FRA53
content-type
application/javascript
x-amz-cf-id
y9QGNstQXhI_u9hwWoJlK1x0Mtchx7gtiJVCE-3ZsoqMzWA9p35VmQ==
via
1.1 ec27b2a550cb7db6ef54f74603010b29.cloudfront.net (CloudFront)
BizibleAcct.js
cdn.bizible.com/
379 B
533 B
Script
General
Full URL
https://cdn.bizible.com/BizibleAcct.js?_biz_u=57adaa143fdd4edd8e879a414bb4662c&_biz_h=-1906410348&cdn_o=a&jsVer=4.17.11.10
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-footer.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
370dddddad5bf9d9d59b97e8aad142793eca491df2960643f2ebb41382809988

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
content-encoding
gzip
etag
310B3839
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
cache-control
private, must-revalidate, max-age=21600
content-type
text/javascript; charset=utf-8
content-length
321
js
www.google-analytics.com/gtm/
68 KB
25 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-KT5NKVW&t=gtm2&cid=1212393751.1569849914
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
20e17e17ebb0ca46fa86d36bbee2e96d3715ea830ffde36b34d313f903094689
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
25297
x-xss-protection
0
expires
Mon, 30 Sep 2019 13:25:14 GMT
collect
www.google-analytics.com/
35 B
99 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=762422824&t=pageview&_s=1&dl=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&ul=en-us&de=UTF-8&dt=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGBAgAADQ~&jid=682817276&gjid=1347098282&cid=1212393751.1569849914&tid=UA-435037-20&_gid=1993280749.1569849914&gtm=2wg9i1WJX6LN3&z=1054466966
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Aug 2019 10:41:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
3293006
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&gjid=1347098282&_gid=1993280749.1569849914&_u=YGBAgAADQ~&z=1453735772
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&_v=j79&z=1453735772
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&_v=j79&z=1453735772&slf_rd=1&random=1551675583
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&_v=j79&z=1453735772&slf_rd=1&random=1551675583
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 30 Sep 2019 13:25:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 30 Sep 2019 13:25:14 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-435037-20&cid=1212393751.1569849914&jid=682817276&_v=j79&z=1453735772&slf_rd=1&random=1551675583
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1831390643754598
connect.facebook.net/signals/config/
307 KB
78 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1831390643754598?v=2.9.4&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
df7777f8816097b3357295bc1803dfcc996e97257148bfb010c86cc57389e8f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id
420120009
pragma
private
x-fb-debug
17E5gxlb01fEndVc9fvgzfJeIwjK4NvtlI2FWTbjgkjBvjD48RmgdksPrpyV4f3zaAlbP9ZLnY6mG2rDLkci+Q==
content-encoding
gzip
x-content-type-options
nosniff
x-frame-options
DENY
date
Mon, 30 Sep 2019 13:25:13 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
private
vary
Accept-Encoding
content-length
79754
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
15 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:14 GMT
Content-Encoding
gzip
Last-Modified
Mon, 23 Sep 2019 16:57:12 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=69922
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
impl-1_31.js
www.gstatic.com/wcm/
31 KB
12 KB
Script
General
Full URL
https://www.gstatic.com/wcm/impl-1_31.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a7270152c4aeda08b74c5adccd10e8dd2769d47fd98a924ba3c4b0e48b7e7a60
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 22 Sep 2019 19:18:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 18 Sep 2018 20:15:00 GMT
server
sffe
age
669984
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
12086
x-xss-protection
0
expires
Mon, 21 Sep 2020 19:18:49 GMT
modules.6aea76fcad17f98bd75d.js
script.hotjar.com/
431 KB
73 KB
Script
General
Full URL
https://script.hotjar.com/modules.6aea76fcad17f98bd75d.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-548479.js?sv=5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.204.210 Chicago, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
pkt-ams-k1-4
Software
/
Resource Hash
e6798df5ccd72cf937ba8d54ecfa773673752f454a4346117f5728d2c649d2b3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
br
last-modified
Thu, 26 Sep 2019 16:28:13 GMT
status
200
etag
"767972bb05e43168de6c884c3cc14a3c"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
section-io-origin-time-seconds
0.053
section-io-origin-status
200
accept-ranges
bytes
section-io-id
db4a4d8533a54af6a07ddd1208d320a7
content-length
74033
ip.json
api.company-target.com/api/v2/
1 KB
1 KB
XHR
General
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&page_title=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&key=11a2abceeefb69ebeb45c693eef1a6b4&src=tag
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/a9777159.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.158.238 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-158-238.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
a2b822bab96a6e095c7309930ececb5c93c84a4f87be1698189c623c8d6e0579

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
x-amz-cf-pop
FRA56
x-cache
Miss from cloudfront
status
200
access-control-max-age
1728000
request-id
ea3e9865-3ac1-471f-8176-7f4d48e9c7ec
x-amz-cf-id
RoGL8eiNwzGVCv6KqKD9-ZiRtF7ZiQupEDxPjDi1cGSlXFjNcRi99A==
pragma
no-cache
access-control-allow-origin
https://www.armor.com
server
nginx
vary
Accept-Encoding, Origin
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 40b36a86ab4ea993a78087b1ceb80e25.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
identification-source
CACHE
expires
Sun, 29 Sep 2019 13:25:14 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAKark67JAQAABVzn-I0uw
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAKark67JAQAABVzn-I0uw&verifyHash=34abc1a9e3a8da784fd60ecbbca2bcbeca09440b
26 B
406 B
Image
General
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAKark67JAQAABVzn-I0uw&verifyHash=34abc1a9e3a8da784fd60ecbbca2bcbeca09440b
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.157.247 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-157-247.fra53.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 30 Sep 2019 13:25:14 GMT
Via
1.1 e1f6fa82d37f125cb361c7c37faf6662.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
ccdc31ae6a659b82
X-Amz-Cf-Id
oa1Eg2ZlkMYv7ZOzch4uejlzPX3cvD0F4LidyXC8_BGyjHSmE_PVsg==

Redirect headers

Date
Mon, 30 Sep 2019 13:25:14 GMT
Via
1.1 e1f6fa82d37f125cb361c7c37faf6662.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAKark67JAQAABVzn-I0uw&verifyHash=34abc1a9e3a8da784fd60ecbbca2bcbeca09440b
Connection
keep-alive
trace-id
93f257102f32e3d3
Content-Length
0
X-Amz-Cf-Id
x3eTUaMU84jVOmz4owbVTfHg7KzZCbabJRjvIY4Bz5CHTTyDPnZv4g==
wcm
www.googleadservices.com/pagead/conversion/1001993991/
67 B
573 B
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/1001993991/wcm?cl=zKOGCPX7n3QQh-7k3QM&fb=18772623473&callback=_callbacks____11y4awnlk
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/impl-1_31.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
63452c670c22063de31b08a57f4535b9995414afd75fdac17c29f9b2d2cab22a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
83
x-xss-protection
0
inferredEvents.js
connect.facebook.net/signals/plugins/
35 KB
10 KB
Script
General
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.4
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
10218
x-xss-protection
0
pragma
public
x-fb-debug
ZzgY9bIz/8tXrtFbaAwern/U68vCeSSnBnXHXAtsO7McQWcmpT5P9FDXvt3A+ssxFpEIVFhI7HTFOcTLOw0lEQ==
x-fb-trip-id
420120009
x-frame-options
DENY
date
Mon, 30 Sep 2019 13:25:14 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
u
cdn.bizible.com/m/
43 B
139 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A381-KPD-482%26token%3A_mch-armor.com-1569849913777-61499&_biz_u=57adaa143fdd4edd8e879a414bb4662c&_biz_s=3cd5a5&_biz_l=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&_biz_t=1569849913917&_biz_i=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&_biz_n=1&rnd=923978&cdn_o=a&_biz_z=1569849914022
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40DD) / ASP.NET
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 30 Sep 2019 13:25:14 GMT
x-aspnetmvc-version
5.2
last-modified
Fri, 27 Sep 2019 04:41:15 GMT
server
ECS (fcn/40DD)
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
0
bat.bing.com/action/
0
92 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5738928&Ver=2&mid=92898d60-f520-34ee-6d64-680ec106dfb7&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Reading,%20Writing,%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&p=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&r=&lt=3384&evt=pageLoad&msclkid=N&rn=407654
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Mon, 30 Sep 2019 13:25:13 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 46023A9E93624381AC1336101718B918 Ref B: VIEEDGE1319 Ref C: 2019-09-30T13:25:14Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
wcm
www.google.de/pagead/attribution/
47 B
193 B
Script
General
Full URL
https://www.google.de/pagead/attribution/wcm?cl=zKOGCPX7n3QQh-7k3QM&fb=18772623473&use_ssct=1&callback=_callbacks____28ah8x2v8
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/impl-1_31.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
dd76fbe5b586d6ebd86956bc2f6b13c96069fd6bf4daf53c2bd94cf005a2c528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
63
x-xss-protection
0
box-90f3a29ef7448451db5af955688970d7.html
vars.hotjar.com/ Frame 138B
0
0
Document
General
Full URL
https://vars.hotjar.com/box-90f3a29ef7448451db5af955688970d7.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-548479.js?sv=5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.83.123 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
pkt-ams-k1-3
Software
/
Resource Hash

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-90f3a29ef7448451db5af955688970d7.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/

Response headers

status
200
date
Mon, 30 Sep 2019 13:25:14 GMT
content-type
text/html
content-length
787
cache-control
max-age=31536000
content-encoding
br
last-modified
Mon, 12 Aug 2019 16:41:40 GMT
etag
"5ee1a7ca3792b75767626ba3f51572aa"
section-io-origin-status
200
section-io-origin-time-seconds
0.052
vary
Accept-Encoding
accept-ranges
bytes
section-io-id
96f6b2464bd1fdd6102823a266c76397
/
www.facebook.com/tr/
44 B
246 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1831390643754598&ev=PageView&dl=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&rl=&if=false&ts=1569849914056&sw=1600&sh=1200&v=2.9.4&r=stable&ec=0&o=30&fbp=fb.1.1569849914054.337737101&it=1569849913990&coo=false&rqm=GET
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Mon, 30 Sep 2019 13:25:14 GMT
i
scout.salesloft.com/
48 B
578 B
XHR
General
Full URL
https://scout.salesloft.com/i
Requested by
Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.194.209.108 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-194-209-108.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
164a7093982355deae877284bbfc2dbcfe6deb5de2c04c0268d7156b2cf08f28

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
server
Cowboy
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.armor.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
48
x-request-id
2n4jkbfjgic16br6h9fjh322
jot.html
platform.twitter.com/ Frame D4B7
Redirect Chain
  • https://syndication.twitter.com/i/jot
  • https://platform.twitter.com/jot.html
0
0
Document
General
Full URL
https://platform.twitter.com/jot.html
Requested by
Host: www.armor.com
URL: https://www.armor.com/app/themes/armor-theme/js/dist/armor-footer.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419C) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Accept-Encoding
gzip, deflate, br
Cookie
personalization_id="v1_Den/NaJF4IKzxHDdkuoFbg=="
Upgrade-Insecure-Requests
1
Origin
https://www.armor.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Mon, 30 Sep 2019 13:25:14 GMT
Etag
"d9592a6c704736fa4da218d4357976dd"
Last-Modified
Mon, 09 Sep 2019 22:21:05 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/419C)
X-Cache
HIT
Content-Length
80

Redirect headers

status
302 302 Found
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length
0
content-type
text/html;charset=utf-8
date
Mon, 30 Sep 2019 13:25:14 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Mon, 30 Sep 2019 13:25:14 GMT
location
https://platform.twitter.com/jot.html
pragma
no-cache
server
tsa_o
strict-transport-security
max-age=631138519
x-connection-hash
b2b8a11048e03ec0a63d9e29932a9f8c
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
118
x-transaction
0014ab45009bb800
x-tsa-request-body-time
0
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0
us
scout.us1.salesloft.com/
42 B
371 B
Image
General
Full URL
https://scout.us1.salesloft.com/us?type=landed&hitId=2122081108&rand=733240816&monitorResolution=1600x1200&viewportResolution=1600x1200&pageTitle=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&sessionCount=1&hasWS=true&time=501&userAgent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&guid=3637e18e-bc0e-469d-9f6f-a5dcdf81e746&tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0Ijo5NDMxfQ.dr7gyFx8D1WAY1Fympf6QhebZ8MqN38xN6fqjM5fblw
Requested by
Host: www.armor.com
URL: https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.204.14.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-204-14-45.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:13 GMT
server
Cowboy
content-type
image/gif; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
42
x-request-id
2n4jkbg9tstpd299ggnvj9t8
ei_track_all_packed.js
dn1f1hmdujj40.cloudfront.net/js/
8 KB
8 KB
Script
General
Full URL
https://dn1f1hmdujj40.cloudfront.net/js/ei_track_all_packed.js
Requested by
Host: web-analytics.engagio.com
URL: https://web-analytics.engagio.com/js/ei.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:e400:c:90ee:6000:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
69cbeb32415361b0f7a1885601c4ca9bbecfdddfd91497c348d1a0bc403dee66

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:24:26 GMT
via
1.1 960a66a5b9d832814160983d391e997c.cloudfront.net (CloudFront)
last-modified
Thu, 26 Sep 2019 21:45:53 GMT
age
48
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=300
x-amz-cf-pop
FRA53-C1
content-length
7719
x-amz-cf-id
tC5ylPMQ2pj91iHOZoFMh7dkh-_HLZBX5vuW49aWxnUgQGldM6Ev0g==
stat
web-analytics.engagio.com/api/
70 B
162 B
Script
General
Full URL
https://web-analytics.engagio.com/api/stat?page_url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&page_title=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&track_type=page&action=ei_view&category=ei_page_tracking&client_id=&account_id=b45ca0d1dad3d3e2b897c64896f66583404b99c4&method=post&callback=EI.api._callbacks.s20464521
Requested by
Host: dn1f1hmdujj40.cloudfront.net
URL: https://dn1f1hmdujj40.cloudfront.net/js/ei_track_all_packed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.55.12.5 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-55-12-5.compute-1.amazonaws.com
Software
/
Resource Hash
78f203b1385236accab86a2ccc02ca08cd89cb074c2adc13681e3533d4038c49

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 30 Sep 2019 13:25:14 GMT
content-length
70
vary
Origin
content-type
text/javascript; charset=utf-8
76669337
va.v.liveperson.net/api/js/
110 B
830 B
Script
General
Full URL
https://va.v.liveperson.net/api/js/76669337?sid=b4R9RI2BRUy0Ojz3zkB3cw&cb=lpCb74654x75616&t=pl&ts=1569849913919&pid=3721661799&tid=3483559582&vid=c5NzIzZjhjMWYxMTU2YjZh
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
72e59973377efeedf1103b1c27b5ada81fad0f51f5fd3fd819ea802a5730e232

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/json
status
200
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
76669337
va.v.liveperson.net/api/js/
42 B
769 B
Script
General
Full URL
https://va.v.liveperson.net/api/js/76669337?sid=b4R9RI2BRUy0Ojz3zkB3cw&cb=lpCb79788x25599&t=uc&ts=1569849913949&pid=3721661799&tid=3483559582&sdes=%5B%7B%22type%22%3A%22pagediv%22%2C%22divId%22%3A%22div-armor-marketing-chat-dev-1%22%7D%5D&vid=c5NzIzZjhjMWYxMTU2YjZh
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
ee86b0aff12b54ef2ab0c9f9faaccad78ad0eac1c41d17f18a7bb2a35102fa3d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:14 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/json
status
200
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
/
www.facebook.com/tr/ Frame A613
0
0
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJX6LN3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
3129
pragma
no-cache
cache-control
no-cache
origin
https://www.armor.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
accept-encoding
gzip, deflate, br
cookie
fr=0j9qW9DoQ930bIF6b..BdkgI6...1.0.BdkgI6.
Origin
https://www.armor.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://www.armor.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-length
0
server
proxygen-bolt
date
Mon, 30 Sep 2019 13:25:14 GMT
/
px.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?time=1569849914578&pid=58768&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&fmt=js&s=1
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1569849914578%26pid%3D58768%26url%3Dhttps%253A%252F%252Fwww.armor.com%252Fthreat-intelligence%25...
  • https://px.ads.linkedin.com/collect/?time=1569849914578&pid=58768&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&fmt=js&s=1&liS...
0
88 B
Script
General
Full URL
https://px.ads.linkedin.com/collect/?time=1569849914578&pid=58768&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&fmt=js&s=1&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e1:105::6cae:b25 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:15 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lva1
status
200
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
20
x-li-uuid
oZIlVC46yRXgPRZPKSsAAA==

Redirect headers

date
Mon, 30 Sep 2019 13:25:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
vary
Accept-Encoding
content-length
20
x-li-uuid
AjtJRi46yRUAIebkMysAAA==
server
Play
pragma
no-cache
x-li-pop
prod-esv5
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=2592000
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect/?time=1569849914578&pid=58768&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&fmt=js&s=1&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
index.html
js.driftt.com/deploy/assets/ Frame 5A30
0
0
Document
General
Full URL
https://js.driftt.com/deploy/assets/index.html
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1569850200000/dfiidzdnakp5.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.90 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-90.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
js.driftt.com
:scheme
https
:path
/deploy/assets/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/

Response headers

status
200
content-type
text/html; charset=utf-8
content-length
938
server
nginx
last-modified
Wed, 25 Sep 2019 17:06:50 GMT
x-amz-server-side-encryption
AES256
accept-ranges
bytes
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 30 Sep 2019 13:25:14 GMT
etag
"d206a06128bdad558a2d10ecc63f04d0"
cache-control
max-age=10
x-cache
Hit from cloudfront
via
1.1 78c402b74e65ae12b398b6b957ab229e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
xSRNVtL1b13Z8L77oCZTlnubhb55PiQdcbw2Qz3-GZVG2CKLFQKQHA==
collect
www.google-analytics.com/
35 B
99 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=762422824&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&ul=en-us&de=UTF-8&dt=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%20962257&_u=aHDAgEADQ~&jid=&gjid=&cid=1212393751.1569849914&tid=UA-435037-20&_gid=1993280749.1569849914&gtm=2wg9i1WJX6LN3&z=1407815478
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Aug 2019 10:41:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
3293010
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
93 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=762422824&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&ul=en-us&de=UTF-8&dt=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Drift%20Widget&ea=Message%20Received&el=Playbook%20ID%3A%20962257&_u=aHDAgEADQ~&jid=&gjid=&cid=1212393751.1569849914&tid=UA-435037-20&_gid=1993280749.1569849914&gtm=2wg9i1WJX6LN3&z=661845120
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Aug 2019 10:41:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
3293010
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
99 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=762422824&t=event&ni=1&_s=4&dl=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&ul=en-us&de=UTF-8&dt=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Drift%20Widget&ea=Message%20Received&el=Playbook%20ID%3A%20962257&_u=aHDAgEADQ~&jid=&gjid=&cid=1212393751.1569849914&tid=UA-435037-20&_gid=1993280749.1569849914&gtm=2wg9i1WJX6LN3&z=310297883
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Aug 2019 10:41:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
3293011
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
us
scout.us1.salesloft.com/
42 B
371 B
Image
General
Full URL
https://scout.us1.salesloft.com/us?type=tick&hitId=2122081108&rand=37885196&monitorResolution=1600x1200&viewportResolution=1600x1200&pageTitle=(1)%20New%20Message!&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&sessionCount=2&hasWS=true&time=5501&userAgent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&guid=3637e18e-bc0e-469d-9f6f-a5dcdf81e746&tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0Ijo5NDMxfQ.dr7gyFx8D1WAY1Fympf6QhebZ8MqN38xN6fqjM5fblw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.204.14.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-204-14-45.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:18 GMT
server
Cowboy
content-type
image/gif; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
42
x-request-id
2n4jkbp34e4b7299ggnvjik8
us
scout.us1.salesloft.com/
42 B
371 B
Image
General
Full URL
https://scout.us1.salesloft.com/us?type=tick&hitId=2122081108&rand=1024703622&monitorResolution=1600x1200&viewportResolution=1600x1200&pageTitle=Reading%2C%20Writing%2C%20and%20Ransomware%3A%20New%20Attacks%20Greet%20Students%20-%20Armor&url=https%3A%2F%2Fwww.armor.com%2Fthreat-intelligence%2Freading-writing-and-ransomware-new-attacks-greet-students%2F&sessionCount=3&hasWS=true&time=10501&userAgent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&guid=3637e18e-bc0e-469d-9f6f-a5dcdf81e746&tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0Ijo5NDMxfQ.dr7gyFx8D1WAY1Fympf6QhebZ8MqN38xN6fqjM5fblw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.204.14.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-204-14-45.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:23 GMT
server
Cowboy
content-type
image/gif; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
42
x-request-id
2n4jkc30507gpd9stpef2883
76669337
va.v.liveperson.net/api/js/
73 B
800 B
Script
General
Full URL
https://va.v.liveperson.net/api/js/76669337?sid=b4R9RI2BRUy0Ojz3zkB3cw&cb=lpCb72390x26870&t=ip&ts=1569849924397&pid=3721661799&tid=3483559582&vid=c5NzIzZjhjMWYxMTU2YjZh
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/76669337/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
0e455eedb3b05a014858bc63423cc02d49129b7adad86e829d1987d24fd3a8fa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.armor.com/threat-intelligence/reading-writing-and-ransomware-new-attacks-greet-students/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 13:25:24 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/json
status
200
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
lpcdn.lpsnmedia.net
URL
https://lpcdn.lpsnmedia.net/le_secure_storage/3.8.0.0-release_461/storage.secure.min.html?loc=https%3A%2F%2Fwww.armor.com&site=76669337&env=prod

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _wpemojiSettings function| $ function| jQuery undefined| oldgs object| punchgs object| _gsScope undefined| oldgs_queue undefined| GreenSockGlobals undefined| _gsQueue object| xhr object| a2a_config function| setREVStartSize object| dataLayer function| twq object| truste object| twttr string| sbiajaxurl object| tribe_l10n_datatables object| a2a object| tribe function| _truste_eu object| PREF_MGR_API_DEBUG object| PrivacyManagerAPI object| TRUSTE_CMAPI_DEBUG object| twemoji object| wp object| lpTag function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin string| SLScoutObject function| slscout object| socTrack object| MktoForms2 object| MunchkinTracker function| _typeof object| proxyless object| lpMTagConfig function| runMain boolean| ctf_js_exists function| jsSHA function| cookie object| html5 function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| jQuery1124019237231888957118 object| Bizible object| BizTrackingA object| BizA function| __twttrll object| __twttr object| fp_utils function| fullpage undefined| projectId object| mtiTracking function| hj object| _hjSettings object| google_tag_manager string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady function| fbq function| _fbq string| _linkedin_data_partner_id function| _googWcmImpl string| _googWcmAk function| _googWcmGet object| uetq function| drift function| driftt object| _eiq object| _engagio_settings object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled function| __extends object| Demandbase object| __db function| DBSegment function| _googWccDebug function| UET object| google_optimize string| google_wcc_status object| _vis_opt_queue boolean| __DRIFTT_WIDGET_INCLUDED__ boolean| __DRIFTT_SHOW_WIDGET_ON_BOOT__ object| EI object| pre_loader object| urlParams function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called

24 Cookies

Domain/Path Name / Value
.armor.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.armor.com/ Name: LPSID-76669337
Value: b4R9RI2BRUy0Ojz3zkB3cw
.armor.com/ Name: _hjid
Value: 2e38783c-c6dc-4950-8dec-e2b6df1938ec
www.armor.com/ Name: sliguid
Value: 3637e18e-bc0e-469d-9f6f-a5dcdf81e746
www.armor.com/ Name: d-a8e6
Value: 66e7dd77-aaf0-4799-8257-b55580415bbf
www.armor.com/ Name: slireg
Value: https://scout.us1.salesloft.com
www.armor.com/ Name: gwcc
Value: %7B%22fallback%22%3A%2218772623473%22%2C%22clabel%22%3A%22zKOGCPX7n3QQh-7k3QM%22%2C%22backoff%22%3A86400%2C%22backoff_expires%22%3A1569936313%7D
.armor.com/ Name: _fbp
Value: fb.1.1569849914054.337737101
.armor.com/ Name: _biz_pendingA
Value: %5B%5D
.armor.com/ Name: _dc_gtm_UA-435037-20
Value: 1
lpcdn.lpsnmedia.net/ Name: lpUnifiedWindow%5C%40%40SessionCookieWrapperstorage_expiration%5C%40%40SessionCookieWrapper76669337
Value: 1569936314028
www.armor.com/ Name: driftt_aid
Value: aa203d87-042c-4e05-875d-cc201526f06d
.armor.com/ Name: _biz_nA
Value: 2
.armor.com/ Name: _gid
Value: GA1.2.1993280749.1569849914
.armor.com/ Name: _ga
Value: GA1.2.1212393751.1569849914
.armor.com/ Name: ei_client_id
Value: 5d92023aa6c2920011b6a74a
www.armor.com/ Name: slirequested
Value: true
.armor.com/ Name: _mkto_trk
Value: id:381-KPD-482&token:_mch-armor.com-1569849913777-61499
www.armor.com/ Name: PHPSESSID
Value: uo63qr910fuaact3gu4d576g84
.armor.com/ Name: _biz_uid
Value: 57adaa143fdd4edd8e879a414bb4662c
.twitter.com/ Name: personalization_id
Value: "v1_Den/NaJF4IKzxHDdkuoFbg=="
www.armor.com/ Name: s-9da4
Value: babfd8ee-2188-4495-90e0-290594637b44
.armor.com/ Name: _biz_sid
Value: 3cd5a5
.armor.com/ Name: LPVID
Value: c5NzIzZjhjMWYxMTU2YjZh

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.armor.com/wp/wp-includes/js/jquery/jquery-migrate.min.js(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

381-kpd-482.mktoresp.com
accdn.lpsnmedia.net
analytics.twitter.com
api.company-target.com
bat.bing.com
cdn-public.sociabble.com
cdn.armor.com
cdn.bizible.com
connect.facebook.net
consent.trustarc.com
d1acp2n11z40zw.cloudfront.net
dn1f1hmdujj40.cloudfront.net
fast.fonts.net
js.driftt.com
lpcdn.lpsnmedia.net
lptag.liveperson.net
match.prod.bidr.io
munchkin.marketo.net
platform.twitter.com
px.ads.linkedin.com
scout-cdn.salesloft.com
scout.salesloft.com
scout.us1.salesloft.com
script.hotjar.com
segments.company-target.com
simple-banner.glitch.me
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
syndication.twitter.com
t.co
tag.demandbase.com
use.fontawesome.com
va.v.liveperson.net
vars.hotjar.com
vidassets.terminus.services
web-analytics.engagio.com
www.armor.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
lpcdn.lpsnmedia.net
104.111.251.133
104.244.42.200
104.244.42.67
104.244.42.69
13.32.158.238
13.32.158.25
143.204.214.90
147.75.204.210
147.75.83.123
147.75.84.99
151.101.12.157
178.249.101.23
192.229.221.91
192.28.147.68
208.89.12.87
216.58.210.2
23.111.9.35
23.111.9.64
2600:9000:214f:ba00:1a:86d5:4300:93a1
2600:9000:214f:e400:c:90ee:6000:21
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:2800:234:660:118e:28f:1d8a:2522
2606:4700:10::6814:6e27
2620:119:50e1:105::6cae:b21
2620:119:50e1:105::6cae:b25
2620:1ec:c11::200
2a00:1450:4001:814::2008
2a00:1450:4001:815::200e
2a00:1450:4001:816::2003
2a00:1450:4001:818::2004
2a00:1450:4001:81d::2003
2a00:1450:400c:c0c::9d
2a02:26f0:6c00:296::25ea
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a03:6400:10:0:178:249:97:98
2a03:6400:10:0:178:249:97:99
34.194.209.108
35.169.17.140
52.204.14.45
52.22.190.58
52.222.157.211
52.222.157.247
52.30.46.130
52.55.12.5
54.171.30.227
93.184.220.178
03f71f7cf4b7044d55aa17f413b7b312d2fe87c21032f0d31a08adce9f54f674
04214d71c2c8c35d5404fbb0f096cb7c3bf17a1dfaf10587a7716de9dc0071a5
04f6fe75ea746ef6eccc7e329feb9a6d010cb9223d984fb5492a3fb6d2d79709
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f
079b03a5c4fac8e8f958095e9954f8072cde83d6eef64f01ea73c3c7e47f382c
0e455eedb3b05a014858bc63423cc02d49129b7adad86e829d1987d24fd3a8fa
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14d88b3a27f0e6de034f86ad42d6411081e9467daf754147f2f16bcb20782177
159dff3bd530baa20e57738b0d8c87e8b3e38d8d58ba6ef85784f0e6fd6e02e2
164a7093982355deae877284bbfc2dbcfe6deb5de2c04c0268d7156b2cf08f28
18bc19ed74bee962fa99f71813ef5d290cb481e211cce34e9c7279f04a808f74
1b8765cc78882472ad251c587e2b236d280c4564b287d835c354637d7b9f2eba
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6f7b22b807f132cd56bd7f8d8d19f6555eb47ef10770812c8b9525e2608fe0
20e17e17ebb0ca46fa86d36bbee2e96d3715ea830ffde36b34d313f903094689
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
24bdf22b6e237ff6f00bdb08bfd0b80f50dd9dbedaba96880c2de544082e1c30
27ead7f47a3fb4d1e7cbef0c68e28bde7ea18923cf41d8ca82ba13584eebc710
27f1894b4c226d8d37278433ff3dd2e448cb877d2cbe818d189fc905195d3422
2fb2b3c269ca19ba745baa2009ae65de9762077a94d97ffb30b647aae435e328
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
34119901f74b4d927c3b3ac787f1b99819174e6308ad5d4cb05ba5409cb5ffa5
345a4178b63432c1976d4d5601c44822394e6caddcfbac6d54e26f5e1438c401
362945725cbb0177031a8405e7553bad5f4cb196870d0f69e7e0800c9f5c38e5
370dddddad5bf9d9d59b97e8aad142793eca491df2960643f2ebb41382809988
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3cd2823fbccb853a60fb14fa44f6118508032ae545648c68960faa9b9a9880ac
3f5c810eed78ba4b258674546b5576ad4e2a10ded140d25205631a8763ea4167
42f08d3fd1152d7c7ae15257b5ff78097c45ee0aca2f76d2927a1115ebad9771
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4ad5ac7ac169c38946be3696e837917de65d3f44f2c5ba250622ea7b478bc0a2
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4ca6b213241815a702f4bcc48945ea383cb8b32ef60547bdb4436b4b6cab420a
55c98973ad75643b7fa9abeb6f381973b66f764386538e8fd7e16b3f969d2f31
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
585107ada7f42329cd4d6ab1d1e87fdf26f4994e8f47d72a44ee8ab5bd291288
596107120d4e37fdd432fd77b9a35ed8cd715d8f0d8143c579c57d3e58282c57
606aeba72580863b6f94f94a6b9d4bda72f17ff65e4adb951356d2a7f545707e
6301fb61e4d37e04e0957e1f5063311f2b3d10c4935f6ce9783b276302b4a650
63452c670c22063de31b08a57f4535b9995414afd75fdac17c29f9b2d2cab22a
64c85e8b3d558b7ced2ce4d184dafd88b8dda0cfb0f388a06a7ff3e8f34841d8
69cbeb32415361b0f7a1885601c4ca9bbecfdddfd91497c348d1a0bc403dee66
6d8f15a09867ac073e71fee08dcc22f0ff9d96ad780f087b551330fb1644e2db
72e59973377efeedf1103b1c27b5ada81fad0f51f5fd3fd819ea802a5730e232
756df835cdc3e6d51abfaa6f2cd0d48a3430e2bcc2c12566e06dc79f3ba4ff74
78f203b1385236accab86a2ccc02ca08cd89cb074c2adc13681e3533d4038c49
794b7354ed6d515c822a9a56d49cb17c5a9368cf53981afcccf71ac46f2a3c74
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
852d6ef7e1f541e29805a611f49b52f6ecb7a47679e966c9264db3c177234ba6
86c47df0704a55ff8824483a2d32a37d567284baa4ba9ab7fb1658d9bc99cc02
8bfc10f52a88db2b9548f9cc4dbc460b0570b6f795e84b0f4e429c421ea2b03d
91f45811a83ee1bd3005eb6df52ef0bf69c1ee66ce0a3b812bc1fbca392473ee
958bb1007d69f98adfd7f7966d348275f35329d7c23d91d6fb7d660d04afdb8f
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9de999e7d4aa267a5acee4a0aed70ae6df10838613e9627a97a63cf47feb173e
a1dad966d318bac62d305a0e05f1b047ed9575c9a7a086041ad24fa920cc6b7d
a1dff8b0c66227748951c4ff891f146f49c5a382ac8e3d6e3c2e9cf8aa560dc8
a2b822bab96a6e095c7309930ececb5c93c84a4f87be1698189c623c8d6e0579
a451f2564c4d093f17562cec045ad8d57dc5ff438a1b7f5831a958e69c962e58
a7270152c4aeda08b74c5adccd10e8dd2769d47fd98a924ba3c4b0e48b7e7a60
ac3eabbaf8163e35b29458577bf04ff6d9e254b69dab0130d242edf69d29b8ec
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad547fb00dd0ab5dcb0eb6da78dd1958de5ea07130c4a660a277b712ebda02ac
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721
b4e9e9bef19c34422f55a7fdb9d10c4db5e39cff24b8c98a0be0e09b2ee6ac2b
b5443203a86a9d8b802b2378c6458dffeb7f29ad991e105e69ca03bb74693e68
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
c2944cd18afec08747955222976eba2eea19258b6e2ede5bb11d8cb106647e4c
cc490a8ef7deb4c7fba66f332ad8cdd39433675b95d2bd341300ab7b718f8e4e
cf7a610c11489bfce177c3c71c5c7aec7101b1ba754d3d2aacc9636fc046c3b6
d8e3d639b5446534fbec951b583b6eb37962a4e82fd4c6c1ff6ca3534de3eb0d
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dca2a46c726b75d682229527df890e8ff2a8a63ed1b59a9f749335f6aa315724
dd76fbe5b586d6ebd86956bc2f6b13c96069fd6bf4daf53c2bd94cf005a2c528
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df7777f8816097b3357295bc1803dfcc996e97257148bfb010c86cc57389e8f8
e05ae076790852a21a47535d8a06e4ebdfc3079536d9c3f9f91d9f5b29303f0e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6798df5ccd72cf937ba8d54ecfa773673752f454a4346117f5728d2c649d2b3
e79e7268e259af85b71a208d363aed33c81e00e448cfeb7f26e2eb21b5672dd2
e7d6ff44c58978483c195976a872481f5f7e3dad18d3c1d735a6f227b388768a
e96cfe81431ab0c70414bc65dd83d59ada01405419c8faca900637fdfffdd48b
ee86b0aff12b54ef2ab0c9f9faaccad78ad0eac1c41d17f18a7bb2a35102fa3d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
f944c3a1f60283099f5ed2983bbd16132f41d272a7c433435fa658e08e5a8aa1
f9626465145ae204fe3ee258b24c9429041c9e134ceaf514803238605152a413
fc71dde0fa1f3434b18e014866b9484f577bc34c8ea80155e0039fe041419fa6
fda9e98004dfb48d2ef7a9c8a2532d83e7d70d246788f99ece81443e8a96db79