events.splunk.com Open in urlscan Pro
142.0.173.20  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://s1528.t.en25.com/e/er?s=1528&lid=45644&elqtrackid=ccd4403780fd4c9a9e91b4508d6d3f6a&elq=58b91cfa93334abdab738b4110c4659d&elqaid=55721&elqat=1 HTTP 302
   https://s1528.t.eloqua.com/e/er?s=1528&lid=45644&elqtrackid=ccd4403780fd4c9a9e91b4508d6d3f6a&elq=58b91cfa93334abdab738b4110c4659d&elqaid=55721&elqat=1 HTTP 302
   https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Page URL
   

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

• https://s1528.t.eloqua.com/visitor/v200/svrGP?pps=60&siteid=1528&PURLSiteID=4&optin=disabled&PURLSiteAlternateDNSID=0&LandingPageID=9615&PURLRecordID=0&PURLGUID=F512091689CA4FBA874BEB62DB1DB9F7&UseRelativePath=True&elq={00000000-0000-0000-0000-000000000000}&firstPartyCookieDomain=events.splunk.com&elqGUID=f5120916-89ca-4fba-874b-eb62db1db9f7&elq_ck=0&utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 HTTP 302
• https://s1528.t.eloqua.com/eloquaimages/tinydot.gif

Request Chain 64

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D66727%26time%3D1676862333452%26url%3Dhttps%253A%252F%252Fevents.splunk.com%252FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%253Futm_medium%253Demail%2526utm_source%253Dsplunk%2526utm_campaign%253DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%2526LST%253DEmail3%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&liSync=true&e_ipv6=AQKQg-GO3Crl6AAAAYZsyKR5ACvo3n5UDnHNW5W-lmF_p-UYoaAZXy5eMKqpfWcfdIZa7e0

Request Chain 107

• https://s.amazon-adsystem.com/iu3?pid=3fcbe918-6424-4b3d-95aa-68d72d53fbd1&event=PageView&ts=1676862338066 HTTP 302
• https://s.amazon-adsystem.com/iu3?pid=3fcbe918-6424-4b3d-95aa-68d72d53fbd1&event=PageView&ts=1676862338066&dcc=t

123 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022 Show response events.splunk.com/ Redirect Chain https://s1528.t.en25.com/e/er?s=1528&lid=45644&elqtrackid=ccd4403780fd4c9a9e91b4508d6d3f6a&elq=58b91cfa93334abdab738b4110c4659d&elqaid=55721&elqat=1 https://s1528.t.eloqua.com/e/er?s=1528&lid=45644&elqtrackid=ccd4403780fd4c9a9e91b4508d6d3f6a&elq=58b91cfa93334abdab738b4110c4659d&elqaid=55721&elqat=1 https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Em...	70 KB 15 KB	1647ms 486ms	Document text/html	142.0.173.20 NETDYNAMICS
General Check archive.org Show headers Download Go to Full URL https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 142.0.173.20 Toronto, Canada, ASN7160 (NETDYNAMICS, US), Reverse DNS Software / Resource Hash 596f0964e1d3d43cd7b629ea233234ea626d018c78d6e6a56e813636a01f99aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store Content-Encoding gzip Content-Length 14314 Content-Type text/html; charset=utf-8 Date Mon, 20 Feb 2023 03:05:31 GMT Expires -1 P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Pragma no-cache Strict-Transport-Security max-age=31536000 Vary Accept-Encoding X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Redirect headers Cache-Control no-store Content-Length 330 Content-Type text/html; charset=utf-8 Date Mon, 20 Feb 2023 03:05:30 GMT Expires -1 Location https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Robots-Tag noindex, nofollow X-Xss-Protection 1; mode=block
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/3.4.1/css/	119 KB 20 KB	136ms 52ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:32 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 1077 age 248521 cdn-cachedat 01/04/2023 09:19:49 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:00 GMT cdn-proxyver 1.03 cdn-requestpullcode 200 server cloudflare etag W/"7f89537eaf606bff49f5cc1a7c24dbca" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 518ec0223ac99664f37f8547a041669f timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 79c4056a9959bb97-FRA cdn-requestpullsuccess True
GET H/1.1	200 OK	%7B6190daac-134e-41a8-a14b-b5f63bdc2cc5%7D_splunk-data-sans.css img.en25.com/Web/SplunkInc/	83 KB 63 KB	168ms 61ms	Stylesheet text/css	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B6190daac-134e-41a8-a14b-b5f63bdc2cc5%7D_splunk-data-sans.css Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash eb9dde5b0100f6fa114a75ec6662bd75575b3d677cff4f70c0545c08300ac2ca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 63906 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Thu, 26 Mar 2020 16:24:34 GMT ETag "18c02998b3d61:0" Vary Accept-Encoding Content-Type text/css Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B618793ed-3c76-4142-9d91-bad602ad2332%7D_style_lp_2020_final.css img.en25.com/Web/SplunkInc/	35 KB 7 KB	172ms 66ms	Stylesheet text/css	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B618793ed-3c76-4142-9d91-bad602ad2332%7D_style_lp_2020_final.css Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash ba991f4664ff4c965307575197a73892fdaf44e2bc7073f4e159dccf2cb4310f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 6599 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Tue, 31 Jan 2023 18:43:09 GMT ETag "aba37cdda335d91:0" Vary Accept-Encoding Content-Type text/css Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7Bc8604310-f703-4114-8ad9-d86aaa409cd4%7D_style_lp_2020_additional.css img.en25.com/Web/SplunkInc/	3 KB 1 KB	166ms 59ms	Stylesheet text/css	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7Bc8604310-f703-4114-8ad9-d86aaa409cd4%7D_style_lp_2020_additional.css Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 7140ad22c7984782117601ce9c164359adff68b070e692079f950473938ccdbe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 776 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Tue, 24 May 2022 13:09:29 GMT ETag "386663806f6fd81:0" Vary Accept-Encoding Content-Type text/css Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H2	200	jquery-1.12.4.min.js Show response code.jquery.com/	95 KB 33 KB	161ms 45ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.12.4.min.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Request headers Referer https://events.splunk.com/ Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:32 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-17b8b" vary Accept-Encoding x-hw 1676862332.dop160.fr8.t,1676862332.cds162.fr8.hn,1676862332.cds167.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 33738
GET H/1.1	200 OK	%7B19a539b9-3a7f-484c-83f4-f542208cddd4%7D_crmt-form-strings_200618-EN.js Show response img.en25.com/Web/SplunkInc/	1 KB 1006 B	187ms 81ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B19a539b9-3a7f-484c-83f4-f542208cddd4%7D_crmt-form-strings_200618-EN.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 6e5b1784c20ec25b8dfd23ce10d089a5ec4c5cd527a87030ea617ed39c190455 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 408 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Thu, 17 Feb 2022 21:03:31 GMT ETag "8fa9acd14124d81:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B96125654-4651-49ca-886d-27933684999e%7D_script-form-2020_final_-_11_11_21_update.js Show response img.en25.com/Web/SplunkInc/	18 KB 5 KB	199ms 93ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B96125654-4651-49ca-886d-27933684999e%7D_script-form-2020_final_-_11_11_21_update.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 54e752d789aafe467b43bac6c58b58ea32d111a889ea2c9385fd821b93945c86 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 4266 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Tue, 30 Nov 2021 05:49:00 GMT ETag "3a6481f9ade5d71:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	25 KB 9 KB	140ms 48ms	Script application/javascript	2606:4700::6813:bb61 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:bb61 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 83f8393c6593831a76ea84324c946029082b5c72507176c13387468d21c651ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 03:05:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 4ki7PtkHDuSPC1vGdOaknQ== age 49416 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 8384 x-ms-lease-status unlocked last-modified Fri, 17 Feb 2023 03:39:12 GMT server cloudflare etag 0x8DB10988962D23B vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 73dada8d-b01e-00ee-560c-43d265000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 79c4056aab1f3614-FRA
GET H/1.1	200 OK	%7B57c9aad4-aabf-4161-943b-819580c527ed%7D_querystring_parameters-01Aug2018.js Show response img.en25.com/Web/SplunkInc/	2 KB 1 KB	167ms 61ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B57c9aad4-aabf-4161-943b-819580c527ed%7D_querystring_parameters-01Aug2018.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 18ebe9bdad62157aa065d81e1395ec746591382b6b663287974e552d46f63274 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 655 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Wed, 08 Aug 2018 11:38:55 GMT ETag "743c8e63c2fd41:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B651b98aa-198d-4b05-a6ac-a0f2cdd19b08%7D_one_submit.js Show response img.en25.com/Web/SplunkInc/	2 KB 1 KB	212ms 46ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B651b98aa-198d-4b05-a6ac-a0f2cdd19b08%7D_one_submit.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash ca39225d55fb1329f98236ee689af42d5c8f21258b7cfe73640c8f7c21220d63 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 922 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Thu, 28 Jan 2016 15:12:17 GMT ETag "feab646de59d11:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/	39 KB 12 KB	132ms 50ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:32 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 722 age 247689 cdn-cachedat 08/20/2022 02:31:33 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:00 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"2f34b630ffe30ba2ff2b91e3f3c322a1" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid b4e3d903277823d1a00b37fb38cd802f timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 79c4056a995abb97-FRA cdn-requestpullsuccess True
GET H/1.1	200 OK	%7B7e5de319-27af-485c-b0b0-c16cacbf63fa%7D_script-lp-2020_2_18_22.js Show response img.en25.com/Web/SplunkInc/	4 KB 2 KB	219ms 52ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B7e5de319-27af-485c-b0b0-c16cacbf63fa%7D_script-lp-2020_2_18_22.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 7d5df92337c2a6e75e735fbc9a5a1c042f9e6c841b0dd5fb5d14921e9ae8d331 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 1082 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Sat, 19 Feb 2022 00:16:30 GMT ETag "5dd4b0f12525d81:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B0522df68-c290-4b2e-9895-ccd3eb9d2fe7%7D_crs.min11-5-18build.js Show response img.en25.com/Web/SplunkInc/	68 KB 38 KB	220ms 49ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B0522df68-c290-4b2e-9895-ccd3eb9d2fe7%7D_crs.min11-5-18build.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash ee1d06c504be0b79406c94743da4698838f25e51e068d0dceeecdc2a2e488c7f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 37928 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Tue, 06 Nov 2018 05:27:50 GMT ETag "cdb86759175d41:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	livevalidation_standalone.compressed.js Show response img.en25.com/i/	13 KB 4 KB	232ms 45ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/i/livevalidation_standalone.compressed.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 36ef1cf6246ce3d596a572d7b0e947a7088eefb1af6373f1a0669c9189a6728e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 3717 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Wed, 11 Jan 2023 20:34:04 GMT ETag "45e8adbfc25d91:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex, nofollow Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	205ms 40ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash 1ae740ebbe1a0c68cdf60b2d5df40126d47e6c69d19bf794b8a99ad5ceb81992 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:32 GMT content-encoding gzip last-modified Fri, 17 Feb 2023 15:03:54 GMT server ECS (frb/67D4) age 13639 etag "757985de142d91:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32316
GET H/1.1	200 OK	%7B22418cbc-7d3c-4da2-bb52-d42bf515f4b3%7D_move-to-top.js Show response img.en25.com/Web/SplunkInc/	561 B 856 B	259ms 60ms	Script application/x-javascript	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/Web/SplunkInc/%7B22418cbc-7d3c-4da2-bb52-d42bf515f4b3%7D_move-to-top.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 209cdfebd5c4a80669ec8c8135abc7be73f3b79f651bd1ec8f4f42a40d56c757 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Date Mon, 20 Feb 2023 03:05:32 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 259 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Mon, 11 Mar 2019 12:12:12 GMT ETag "442dd5a83d8d41:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7Bc2860ed1-6832-472d-a189-e585f719bd55%7D_lp-splunk-logo.png img.en25.com/EloquaImages/clients/SplunkInc/	2 KB 3 KB	60ms 59ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7Bc2860ed1-6832-472d-a189-e585f719bd55%7D_lp-splunk-logo.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 56b9ae4b38839806728d30132175df8c0165174bffd66d91b8f69925ef668ca5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Tue, 14 Apr 2020 15:23:57 GMT ETag "7d733b77012d61:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 2412 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B467b6802-ce77-4a92-aed8-3d9b3474d26a%7D_Arrow.png img.en25.com/EloquaImages/clients/SplunkInc/	2 KB 2 KB	65ms 64ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7B467b6802-ce77-4a92-aed8-3d9b3474d26a%7D_Arrow.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 0211cd110c45f7728d81032c691444f922b223042456c334e5edae5cbb6ebca5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Mon, 04 Mar 2019 17:18:09 GMT ETag "f344563daed2d41:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 1662 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7Bd902cd8e-0a03-45d7-92cb-da9d9b63e6f1%7D_FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware_240301_Icon.png img.en25.com/EloquaImages/clients/SplunkInc/	23 KB 24 KB	473ms 471ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7Bd902cd8e-0a03-45d7-92cb-da9d9b63e6f1%7D_FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware_240301_Icon.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 2e9e09249302716d73e7e15c146d93ec4fc42d1bccef8c554d4117130a04c3a3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:33 GMT X-Content-Type-Options nosniff Last-Modified Wed, 01 Jun 2022 07:30:05 GMT ETag "1672d6a8975d81:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 23711 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:33 GMT
GET H/1.1	200 OK	%7B0b84d53d-96ee-4d81-9c62-6183ea0331b2%7D_FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware_240301_Sponsor_Logo.png img.en25.com/EloquaImages/clients/SplunkInc/	12 KB 13 KB	630ms 628ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7B0b84d53d-96ee-4d81-9c62-6183ea0331b2%7D_FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware_240301_Sponsor_Logo.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 0a514ce9436fa6aceaa19e70ce3703598a518c9d692969da49d4ec977d98f08f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:33 GMT X-Content-Type-Options nosniff Last-Modified Wed, 01 Jun 2022 07:30:05 GMT ETag "1672d6a8975d81:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 12273 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:33 GMT
GET H/1.1	200 OK	%7Be9588963-1d22-435c-8dc1-9a133fb4fdce%7D_fb.png img.en25.com/EloquaImages/clients/SplunkInc/	238 B 774 B	53ms 51ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7Be9588963-1d22-435c-8dc1-9a133fb4fdce%7D_fb.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 54f746f34aede748df2339a8d8ead0b63c923c4556ca8c571d87f7e87bf79daa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Fri, 01 May 2020 14:26:25 GMT ETag "99ab9b7ec41fd61:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 238 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B60e51f68-a39f-4354-a788-b44f60d7fd39%7D_instagram.png img.en25.com/EloquaImages/clients/SplunkInc/	416 B 951 B	65ms 64ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7B60e51f68-a39f-4354-a788-b44f60d7fd39%7D_instagram.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 0cfb01c59089b6e8884979e7000714cca38deffa7ab26109c694a55ce73e44f9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Mon, 18 May 2020 16:52:58 GMT ETag "67dd9c8342dd61:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 416 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7Be41b4de4-03a0-4aee-8617-6f9079f83190%7D_in.png img.en25.com/EloquaImages/clients/SplunkInc/	305 B 841 B	50ms 49ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7Be41b4de4-03a0-4aee-8617-6f9079f83190%7D_in.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 718101d7a02bf9d05e6607fdf87b99d90bc9193f97590ba69eab4ad87f8b2485 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Fri, 01 May 2020 14:26:25 GMT ETag "99ab9b7ec41fd61:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 305 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B22d85331-213f-4ed7-b4c8-cafe0b9bc236%7D_tw.png img.en25.com/EloquaImages/clients/SplunkInc/	315 B 851 B	55ms 54ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7B22d85331-213f-4ed7-b4c8-cafe0b9bc236%7D_tw.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 5ed5fcce46bb4fd8a28b61d36cf60873c102829299f6f5576d799e0366509716 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Fri, 01 May 2020 14:26:25 GMT ETag "99ab9b7ec41fd61:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 315 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7Bdf143b54-578b-4534-b8fa-2f9be627da3f%7D_yt.png img.en25.com/EloquaImages/clients/SplunkInc/	312 B 848 B	53ms 52ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7Bdf143b54-578b-4534-b8fa-2f9be627da3f%7D_yt.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash ea77ea1df7794b630ff8be882c7af3373b04182981955646f6842fbf6ee36d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Fri, 01 May 2020 14:26:25 GMT ETag "99ab9b7ec41fd61:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 312 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7Bbe01ff5c-0d28-440b-90ce-8a51f1ee0a7c%7D_2019-Splunk-Corp-Logo-w-tag-101_W-Horizontal_1.png img.en25.com/EloquaImages/clients/SplunkInc/	3 KB 4 KB	49ms 49ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7Bbe01ff5c-0d28-440b-90ce-8a51f1ee0a7c%7D_2019-Splunk-Corp-Logo-w-tag-101_W-Horizontal_1.png Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 463b1656517135e0f8ebaa634113c71af5e16063afa0c2ec65542e57884d1d30 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Fri, 06 Mar 2020 12:19:32 GMT ETag "a1a0fd7db1f3d51:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 3491 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	tinydot.gif s1528.t.eloqua.com/eloquaimages/ Redirect Chain https://s1528.t.eloqua.com/visitor/v200/svrGP?pps=60&siteid=1528&PURLSiteID=4&optin=disabled&PURLSiteAlternateDNSID=0&LandingPageID=9615&PURLRecordID=0&PURLGUID=F512091689CA4FBA874BEB62DB1DB9F7&Use... https://s1528.t.eloqua.com/eloquaimages/tinydot.gif	49 B 541 B	169ms 168ms	Image image/gif	142.0.173.31 NETDYNAMICS
General Check archive.org Show headers Download Go to Show image Full URL https://s1528.t.eloqua.com/eloquaimages/tinydot.gif Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Server 142.0.173.31 Toronto, Canada, ASN7160 (NETDYNAMICS, US), Reverse DNS Software / Resource Hash f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Wed, 11 Jan 2023 20:34:01 GMT ETag "dc82bafc25d91:0" Content-Type image/gif P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Cache-Control no-store Accept-Ranges bytes X-Robots-Tag noindex, nofollow Content-Length 49 X-XSS-Protection 1; mode=block Expires -1 Redirect headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Content-Type text/html; charset=utf-8 Location /eloquaimages/tinydot.gif P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Cache-Control no-store X-Robots-Tag noindex, nofollow Content-Length 142 X-Xss-Protection 1; mode=block Expires -1
GET H2	200	9ff638b7-8097-449d-9741-7b3c526b0da7.json Show response cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/	4 KB 2 KB	153ms 71ms	XHR application/x-javascript	2606:4700::6813:bb61 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/9ff638b7-8097-449d-9741-7b3c526b0da7.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:bb61 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1ecd1124c471a4eab3d691815fcded4b03c38c1453ad4ba9d65f59b3361e6795 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 03:05:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 qQVJQDN+KbjVN5+PkFGTLA== strict-transport-security max-age=31536000; includeSubDomains; preload content-length 1587 x-ms-lease-status unlocked last-modified Mon, 21 Nov 2022 22:14:17 GMT server cloudflare etag 0x8DACC0DBB26D0FF vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 7fc654a1-d01e-0010-79f6-fdee00000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 79c4056c2fe39baa-FRA expires Tue, 21 Feb 2023 03:05:32 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	520 KB 127 KB	169ms 81ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 6873500fd3d1c93403cf710d1079e4eb193ae231ceaed4e40d781bd2d7c251de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:32 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 129902 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 20 Feb 2023 03:05:32 GMT
GET H/1.1	200 OK	%7B5592f5f4-57ed-459f-9a04-883e7de0f1d1%7D_FY23Q2_DIG_APAC_WBR_PTF_JP_adoption_MLTK_Overview_238201_LP.jpg img.en25.com/EloquaImages/clients/SplunkInc/	40 KB 41 KB	517ms 481ms	Image image/jpeg	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7B5592f5f4-57ed-459f-9a04-883e7de0f1d1%7D_FY23Q2_DIG_APAC_WBR_PTF_JP_adoption_MLTK_Overview_238201_LP.jpg Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash fb169edc03132aa2fdae0266be6cccea74a8f16b56f854e0ad81584757ed270b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:33 GMT X-Content-Type-Options nosniff Last-Modified Wed, 18 May 2022 06:07:56 GMT ETag "4f7f459e7d6ad81:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/jpeg Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 41182 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:33 GMT
GET DATA	200 OK	truncated /	21 KB 21 KB		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash aa6b8c0d433eb522e39d9a179e360a6eb5980c9f3addb3e80ad4fffee9e736b8 Request headers Referer Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type application/x-font-woff2;charset=utf-8
GET DATA	200 OK	truncated /	20 KB 20 KB		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81406743991f669003544635208cddc5ab38874529b1c425fb60ceb02e8f1218 Request headers Referer Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type application/x-font-woff2;charset=utf-8
GET DATA	200 OK	truncated /	21 KB 21 KB		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d707ba511936ff11eb80a227510ad8e82667fce06d11a9cdb0b1f00b56be0798 Request headers Referer Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type application/x-font-woff2;charset=utf-8
GET DATA	200 OK	truncated /	119 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3abb9c51b30aa2f09fe1c74f5ae5dd176efb43bb451e67e34943e7e77f13e1ad Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	%7B60d048aa-77a0-4ba1-98f6-9835b9eabcfa%7D_splunk-half-size-circle.png img.en25.com/EloquaImages/clients/SplunkInc/	10 KB 11 KB	55ms 54ms	Image image/png	104.109.80.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://img.en25.com/EloquaImages/clients/SplunkInc/%7B60d048aa-77a0-4ba1-98f6-9835b9eabcfa%7D_splunk-half-size-circle.png Requested by Host: img.en25.com URL: https://img.en25.com/Web/SplunkInc/%7B618793ed-3c76-4142-9d91-bad602ad2332%7D_style_lp_2020_final.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.80.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-80-206.deploy.static.akamaitechnologies.com Software / Resource Hash 10e4d663f3320b73cccb9c0876afbfa7102e583e297d985c9b49a5335798a292 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://img.en25.com/Web/SplunkInc/%7B618793ed-3c76-4142-9d91-bad602ad2332%7D_style_lp_2020_final.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains; preload Date Mon, 20 Feb 2023 03:05:32 GMT X-Content-Type-Options nosniff Last-Modified Wed, 17 Aug 2022 12:08:10 GMT ETag "2d3bd9432b2d81:0" P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Content-Type image/png Cache-Control no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag noindex Content-Length 10497 X-XSS-Protection 1; mode=block Expires Mon, 20 Feb 2023 03:05:32 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 304 B	151ms 57ms	XHR application/json	2606:4700:4400::ac40:9062 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9062 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * cf-ray 79c4056d3ec9365f-FRA access-control-allow-headers Content-Type
GET H2	200	ipv cdn.bizible.com/m/	43 B 304 B	41ms 40ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=af4b25a06b134364a1bc9c70103b8243&_biz_s=19d9f2&_biz_l=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&_biz_t=1676862332952&_biz_i=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&_biz_n=0&rnd=445261&cdn_o=a&_biz_z=1676862332953 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6760) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:32 GMT last-modified Wed, 15 Feb 2023 14:12:17 GMT server ECS (frb/6760) age 391995 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 203 B	59ms 39ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=af4b25a06b134364a1bc9c70103b8243&_biz_s=19d9f2&_biz_l=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&_biz_t=1676862332957&_biz_i=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&rnd=586186&cdn_o=a&_biz_z=1676862332957 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:32 GMT last-modified Thu, 16 Feb 2023 23:58:42 GMT server ECS (frb/67C2) age 270410 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 523 B	149ms 149ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=af4b25a06b134364a1bc9c70103b8243&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.11.28 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 480125be4c21941c2a9e695ac6565f1ce4bb80a29cf216b72120946a6479ad11 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:32 GMT content-encoding gzip server ECS (frb/6711) etag 00A2405C vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 content-length 218
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.18.0/	377 KB 84 KB	49ms 48ms	Script application/javascript	2606:4700::6813:bb61 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.18.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:bb61 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bf8fce049c8e10f0a036f50f5eb7c8dde06dc5bee833635f9db82de6f51f2418 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 cIchS4lr7UaDx9LQCq2apA== age 76602 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 85787 x-ms-lease-status unlocked last-modified Mon, 24 May 2021 01:24:55 GMT server cloudflare etag 0x8D91E52BCFB1A90 vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 8410bbf9-f01e-0121-31dd-0bf382000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 79c4056dbd6c3614-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/b7951409-db27-43d8-a4d6-4a3aaf33d3dd/	199 KB 35 KB	69ms 69ms	Fetch application/x-javascript	2606:4700::6813:bb61 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/9ff638b7-8097-449d-9741-7b3c526b0da7/b7951409-db27-43d8-a4d6-4a3aaf33d3dd/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.18.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:bb61 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b754b99619399bfbf7f3e8a8fa1e19b973b1ce7d6d9d1ad6dc1914289a7154b6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 hfNC+9vBcpYYPHqNO7A9kQ== strict-transport-security max-age=31536000; includeSubDomains; preload content-length 35340 x-ms-lease-status unlocked last-modified Mon, 21 Nov 2022 22:14:21 GMT server cloudflare etag 0x8DACC0DBD6B65E8 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 1ddb0f21-a01e-0176-5cf8-fd1a0f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 79c4056e69b99baa-FRA expires Tue, 21 Feb 2023 03:05:33 GMT
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.18.0/assets/	12 KB 3 KB	74ms 74ms	Fetch application/json	2606:4700::6813:bb61 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.18.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.18.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:bb61 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb1fa7363d6e4772f7c49d67f031d68f209e66de6c3c05aade6fdc57a02505c1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 MrQfM8mTXwqoZ1+V6sXNuw== strict-transport-security max-age=31536000; includeSubDomains; preload content-length 2938 x-ms-lease-status unlocked last-modified Mon, 24 May 2021 01:24:48 GMT server cloudflare etag 0x8D91E52B88C8775 vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id 141518a6-f01e-0025-647f-584055000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 79c4056f0a2c9baa-FRA
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	194ms 52ms	Script text/javascript	2a00:1450:400d:806::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 01:12:06 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 6807 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20085 expires Mon, 20 Feb 2023 03:12:06 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	154ms 41ms	Script application/x-javascript	2a02:26f0:3500:16::215:149b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 10 Jan 2023 17:22:56 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=61999 accept-ranges bytes content-length 4777
GET H2	200	bat.js Show response bat.bing.com/	38 KB 12 KB	161ms 63ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 1d26490f083b209ef29e08d092649725edf15ac2b33ad62fdeaafd37f7d79d6f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Mon, 20 Feb 2023 03:05:33 GMT last-modified Mon, 23 Jan 2023 19:59:24 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 3FE9C147EA61466A9F317EA38431D83B Ref B: FRA31EDGE0809 Ref C: 2023-02-20T03:05:33Z etag "076bc30652fd91:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 11552
GET H2	200	tfa.js Show response cdn.taboola.com/libtrc/unip/1341559/	58 KB 18 KB	137ms 40ms	Script application/javascript	151.101.193.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/unip/1341559/tfa.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.44 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash f97631035deae59d3cf5394e855388e75c52324a86be771ee7fde1ec518462d3 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-amz-version-id BLw16cU1yqLu4O6TCv6qZgahIPGbQn1z content-encoding gzip via 1.1 varnish date Mon, 20 Feb 2023 03:05:33 GMT x-amz-request-id 29TH4Z6ZFXZYYV4X age 17 x-cache HIT x-amz-replication-status COMPLETED content-length 18371 x-amz-id-2 gJc8LEpqvoBYMY3+AKhbFFEVJ6Nce/hhYeiK81T03nT7rctmE7wCquSu/J/BtK58oKyWVT1Q/MY= x-served-by cache-hhn-etou8220068-HHN last-modified Sun, 19 Feb 2023 11:14:57 GMT server AmazonS3 x-timer S1676862333.408751,VS0,VE1 etag "7134fa01cb41dd6d247f1d01deb68d72" vary Accept-Encoding content-type application/javascript; charset=utf-8 abp 74 access-control-allow-origin * cache-control private,max-age=14401 accept-ranges bytes x-cache-hits 1
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	23 KB 8 KB	136ms 40ms	Script application/javascript	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Mon, 23 Jan 2023 21:56:14 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "03d5db9dfd00a5719bb4c9261e6fa1bb" vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7356
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	106 KB 28 KB	134ms 42ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash dca9b6afcb6c37d6a32456973fe5f2986a348a70d11774e102de6fc420992a19 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 03:05:33 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27843 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug LftohN+uCOUgd7bgK9yUtwElWW7kBSRbqf4iIjUkBWYBP7wdr8KeVHBMs7lxRAcldpqo/l1H0iEN1/QLdQD22w== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 2050670934 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	up_loader.1.1.0.js Show response js.adsrvr.org/	4 KB 2 KB	105ms 29ms	Script application/x-javascript	18.64.82.184 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/up_loader.1.1.0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.64.82.184 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-82-184.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Sun, 19 Feb 2023 15:58:06 GMT Content-Encoding gzip Via 1.1 5bab9b28b9df8c7c6cb942e5654e9558.cloudfront.net (CloudFront) Last-Modified Thu, 24 Sep 2020 15:15:34 GMT Server AmazonS3 X-Amz-Cf-Pop TXL50-P2 Age 40048 ETag W/"98d98b3499058b76d58073cf8ede2f10" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/x-javascript X-Cache Hit from cloudfront Connection keep-alive X-Amz-Cf-Id kOOJZKMbRUrjPrzUm5p3wNARkDeXkRcB5u2w4mWguZv1SRXysjoYzw==
GET H2	200	cs.js Show response tm.vendemore.com/cs/32fde63c-3af6-4cd0-a131-51e4701d5575/v2/	408 B 562 B	168ms 44ms	Script application/javascript	3.120.63.212 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tm.vendemore.com/cs/32fde63c-3af6-4cd0-a131-51e4701d5575/v2/cs.js?c=1676862333312 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 3.120.63.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-120-63-212.eu-central-1.compute.amazonaws.com Software / Resource Hash 6bd6f89b1e7f7eef3650d12eb6b8b0b9a839034f1917cccfafb5d22f549d5529 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip access-control-max-age 3600 vary Accept-Encoding access-control-allow-methods POST, PUT, GET, OPTIONS, DELETE access-control-allow-origin * content-type application/javascript;charset=utf-8 access-control-allow-headers Authorization, Content-Type, username, password
GET H2	200	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	6 KB 6 KB	148ms 44ms	Script application/x-javascript	205.185.216.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 205.185.216.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map2.hwcdn.net Software / Resource Hash 10261b710e399a8cee22c8ff4118167d91ac58254f5bf0291036d2219dd5cf25 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT strict-transport-security max-age=15552000; includeSubDomains; preload last-modified Thu, 22 Sep 2022 17:10:43 GMT x-amz-request-id tx00000000000003825a169-0063ece3f9-4a0aef22-sfo2a etag "9a8767fa98da937fb02cdbbc52a101bb" vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin x-hw 1676862333.dop103.fr8.t,1676862333.cds155.fr8.hn,1676862333.cds270.fr8.c content-type application/x-javascript cache-control max-age=211708 x-rgw-object-type Normal accept-ranges bytes content-length 5776
GET H2	200	6si.min.js Show response j.6sc.co/	33 KB 10 KB	162ms 46ms	Script application/javascript	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 09 Feb 2023 18:18:39 GMT server nginx/1.14.0 (Ubuntu) etag "63e538ff-820b" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 10438 expires Mon, 20 Feb 2023 03:05:33 GMT
GET H2	200	rz5la3FlMSNo3OYdIkfj Show response ws.zoominfo.com/pixel/	2 KB 2 KB	290ms 190ms	Script text/javascript	2606:4700::6810:a852 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/rz5la3FlMSNo3OYdIkfj Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 34ad1482ae9a2908caab0825391c008b0c903c9f7737840b4494bc917a2b6d97 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 79c40570994268fe-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	obtp.js Show response amplify.outbrain.com/cp/	17 KB 6 KB	144ms 40ms	Script application/x-javascript	23.35.237.86 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://amplify.outbrain.com/cp/obtp.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.35.237.86 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-35-237-86.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 3c4aacb974ed3d0a3d1f57bebc8d97897ce027b0751a5f0da9ee697a825c2f1a Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:05:33 GMT Content-Encoding gzip Last-Modified Thu, 02 Feb 2023 09:48:30 GMT Server AkamaiNetStorage ETag "b07048fb19f7c325242e254218118e14:1675339769.124179" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=1200 Connection keep-alive Accept-Ranges bytes Content-Length 5911 Expires Mon, 20 Feb 2023 03:25:33 GMT
GET H2	200	alloy.min.js Show response cdn1.adoberesources.net/alloy/2.6.4/	70 KB 20 KB	192ms 45ms	Script application/x-javascript	2a02:26f0:3500:591::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn1.adoberesources.net/alloy/2.6.4/alloy.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Akamai Resource Optimizer / Resource Hash d42d86b25af8cc91bada9c95f06d5d2c738163b2bd32873361ca42c3f60fae8c Security Headers Name Value Strict-Transport-Security max-age=86400 ; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding br strict-transport-security max-age=86400 ; includeSubDomains last-modified Thu, 31 Mar 2022 01:13:08 GMT server Akamai Resource Optimizer etag "787f60672bffd0cf1097551d3e8402f0:1631031601.918846" vary Accept-Encoding content-type application/x-javascript cache-control max-age=3600 accept-ranges bytes content-length 20183 expires Mon, 20 Feb 2023 04:05:33 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	205 KB 72 KB	56ms 56ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-5EPM2P39FV&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8f5a96acef238e29171b9c509c3bacfccdf92093da9dd9fc6beb5ac14555e5bf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 73791 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 20 Feb 2023 03:05:33 GMT
GET DATA	200 OK	truncated /	817 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3	200	destination Show response www.googletagmanager.com/gtag/	215 KB 76 KB	57ms 56ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=G-8Q6D4RLYQL&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-5EPM2P39FV&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 95eb9df15397119e307ae593702a672224ca113087636b69a1029b92ae396445 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 77342 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 20 Feb 2023 03:05:33 GMT
GET H2	200	collect Show response sgtm.splunk.com/g/	65 B 358 B	527ms 319ms	XHR text/plain	2600:1901:0:a57b:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sgtm.splunk.com/g/collect?v=2&tid=G-5EPM2P39FV&gtm=45je32f0&_p=2009442898&_gaz=1&cid=1675861238.1676862333&ul=en-us&sr=1600x1200&_fplc=0&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&sst.uc=DE&_s=1&sid=1676862333&sct=1&seg=0&dl=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&dt=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&en=page_view&_fv=1&_nsi=1&_ss=1&ep.cookieDomain=auto&ep.allowLinker=true&ep.gtm_tag_name=sGTM%20GA4%20-%20Page%20View&ep.gtm_settings=GTM-TPV7TP%20%7C%20593%20%7C%20&ep.hit_timestamp=2023-02-20T03%3A05%3A33.295%2B00%3A00&richsstsse Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:a57b:: Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT via 1.1 google x-content-type-options nosniff server Google Frontend content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-accel-buffering no
POST H2	204	collect stats.g.doubleclick.net/g/	0 47 B	142ms 49ms	Ping text/plain	2a00:1450:4025:402::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-5EPM2P39FV&cid=1675861238.1676862333&gtm=45je32f0&aip=1 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4025:402::9c Den Helder, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT server Golfe2 content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	141ms 51ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-5EPM2P39FV&cid=1675861238.1676862333&gtm=45je32f0&aip=1&z=1976335811 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	rp.gif alb.reddit.com/	42 B 157 B	227ms 134ms	Image image/gif	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1676862333437&id=t2_4moesf6e&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=02576e3b-2f76-4fd9-80db-81ac2cbe4d6b&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT via 1.1 varnish server Varnish content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	json Show response trc.taboola.com/1341559/trc/3/	2 KB 2 KB	66ms 59ms	Script application/javascript	151.101.193.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://trc.taboola.com/1341559/trc/3/json?tim=1676862333446&data=%7B%22id%22%3A962%2C%22ii%22%3A%22%2Fsecurity-with-surge-analysis-of-10-major-ransomware-strains-june2022%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1676862333440%2C%22cv%22%3A%2220230219-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dsplunk-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1676862333445%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3%22%2C%22tos%22%3A2%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22ler%22%3A%22other%22%2C%22supv%22%3Atrue%7D%7D&pubit=i Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/unip/1341559/tfa.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.44 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f2d9615ce5b870d754555e012582ecc69fb0232c1a5667eb403b424f9a9caa41 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-vcl-time-ms 20 date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip via 1.1 varnish x-served-by cache-hhn-etou8220068-HHN server nginx x-timer S1676862333.489798,VS0,VE20 vary Accept-Encoding x-cache MISS p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * content-type application/javascript; charset=utf-8 access-control-allow-credentials true accept-ranges bytes x-cache-hits 0
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/66727/domain/events.splunk.com/	36 B 369 B	296ms 187ms	XHR application/json	2600:9000:225f:2400:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/66727/domain/events.splunk.com/token Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225f:2400:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding gzip via 1.1 00d7096d979158a97e3d45ef36d6ae4a.cloudfront.net (CloudFront) x-amz-cf-pop TXL50-P2 vary accept-encoding x-cache Miss from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id Ua6KJtQDYP35XggYvCvN8DYtw7aIg1Fzf07Ni95EwRN1OpIweShI_Q==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D66727%26time%3D1676862333452%26url%3Dhttps%253A%252F%252Fevents.splunk.com%252FSe... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%...	0 267 B	304ms 185ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&liSync=true&e_ipv6=AQKQg-GO3Crl6AAAAYZsyKR5ACvo3n5UDnHNW5W-lmF_p-UYoaAZXy5eMKqpfWcfdIZa7e0 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:34 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: E25F3FD674A14BF98FE007D7CE693B61 Ref B: DUS30EDGE0314 Ref C: 2023-02-20T03:05:34Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAX1GO/HICm3vJ/aTUKdag== Redirect headers date Mon, 20 Feb 2023 03:05:33 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 2D6B0A04C25A45DC99943FAE06346BAC Ref B: DUS30EDGE0818 Ref C: 2023-02-20T03:05:34Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=66727&time=1676862333452&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&liSync=true&e_ipv6=AQKQg-GO3Crl6AAAAYZsyKR5ACvo3n5UDnHNW5W-lmF_p-UYoaAZXy5eMKqpfWcfdIZa7e0 x-li-proto http/2 content-length 0 x-li-uuid AAX1GO/CYoM3Q1mGyQydEw==
GET H2	204	5962822.js Show response bat.bing.com/p/action/	0 119 B	150ms 149ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/5962822.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Mon, 20 Feb 2023 03:05:33 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 675942D83F1C41FDBEE8EA92FBCC8965 Ref B: FRA31EDGE0809 Ref C: 2023-02-20T03:05:33Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 287 B	63ms 62ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=5962822&tm=gtm002&Ver=2&mid=c59356af-3390-455e-bc4b-73acfe92ba65&sid=70bcbe60b0cb11ed8593a14d1a45a538&vid=70bcf110b0cb11ed8be2afb7d83a243c&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&kw=Security,%20Ransomware,%20Threats,%20Ransomware%20Strains,%20Encryption%20Speed,%20Mitigation,%20Response,%20Security%20Attacks&p=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&r=&lt=4431&evt=pageLoad&sv=1&rn=21901 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Mon, 20 Feb 2023 03:05:33 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: C5AEC3279A3D4F4FA65D0752B7B27381 Ref B: FRA31EDGE0809 Ref C: 2023-02-20T03:05:33Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	analytics-an-min.js Show response d2hya7iqhf5w3h.cloudfront.net/scripts/	4 KB 5 KB	107ms 29ms	Script application/javascript	18.64.84.41 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2hya7iqhf5w3h.cloudfront.net/scripts/analytics-an-min.js Requested by Host: tm.vendemore.com URL: https://tm.vendemore.com/cs/32fde63c-3af6-4cd0-a131-51e4701d5575/v2/cs.js?c=1676862333312 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.64.84.41 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-84-41.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash 856480dfbd572e8e51fd582b4744916dc6708b2cf12eb311d749f0dc16250410 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:01:30 GMT Via 1.1 23f4d6fe05b7a037f9e8a8a9a9896368.cloudfront.net (CloudFront) Last-Modified Wed, 05 May 2021 13:48:14 GMT Server AmazonS3 X-Amz-Cf-Pop TXL50-P2 Age 5306 ETag "e2295ad89bc05d51307a0a73d8f7aa14" X-Cache Hit from cloudfront Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 4603 X-Amz-Cf-Id OH0F2s1rSlZPpx-6zX7LVyv4Jx8mDM80wfgoyrBEI3ZuRTMlu7gf2A==
GET H2	200	1642523699107798 Show response connect.facebook.net/signals/config/	377 KB 108 KB	42ms 41ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1642523699107798?v=2.9.96&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash d7d5821806775569c0c0fdb33a95df3b9e8aad2404695252fd6976c6f311f690 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 20 Feb 2023 03:05:33 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 110314 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug /k82a09t5ZaxL9faOSNM8+3raQGqkyWXyZu44mCf2wtZJq0rtHzUkPKFUufL14biTSuA9ErJ/vROQSYdV/OAOQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 2050670934 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	linkid.js Show response www.google-analytics.com/plugins/ua/	2 KB 1 KB	55ms 54ms	Script text/javascript	2a00:1450:400d:806::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/linkid.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 02:27:14 GMT content-encoding gzip x-content-type-options nosniff age 2299 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 859 x-xss-protection 0 last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type text/javascript cache-control public, max-age=3600 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Mon, 20 Feb 2023 03:27:14 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 255 B	136ms 46ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-8Q6D4RLYQL&gtm=45je32f0&_p=2009442898&cid=1675861238.1676862333&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1676862333&sct=1&seg=0&dl=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&dt=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&en=page_view&_fv=1&_ss=1&ep.gtm_tag_name=GA4%20-%20Page%20View&ep.hit_timestamp=2023-02-20T03%3A05%3A33.295%2B00%3A00 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT server Golfe2 content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 817 B	139ms 43ms	XHR application/json	185.89.210.141 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Date Mon, 20 Feb 2023 03:05:33 GMT AN-X-Request-Uuid e1d81645-85f9-4167-add7-06aadc553647 Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://events.splunk.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 80.255.7.100; 80.255.7.100; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 203 B	49ms 40ms	XHR text/html	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://events.splunk.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 254 B	140ms 41ms	XHR text/html	2a02:26f0:6c00:1b5::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:1b5::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash c0ad39faea959c6452ccf07bbf3c65bf7f5e1afa8df00d05cfbb1087a8aee9ac Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT vary Origin content-type text/html access-control-allow-origin https://events.splunk.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::6 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 19 expires Mon, 20 Feb 2023 03:05:33 GMT
POST H2	200	collect www.google-analytics.com/	35 B 242 B	73ms 73ms	Ping image/gif	2a00:1450:400d:806::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/collect Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type image/gif access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 350 B	71ms 48ms	XHR text/plain	2a00:1450:4025:402::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=2011908932&gjid=1009798479&_gid=1891073734.1676862334&_u=aCDAiUAjBAAAAEAFK~&z=2107201132 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4025:402::9c Den Helder, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	cachedClickId Show response tr.outbrain.com/	35 B 194 B	471ms 112ms	Script application/javascript	70.42.32.95 AS-OUTBRAIN
General Check archive.org Show headers Download Go to Full URL https://tr.outbrain.com/cachedClickId?marketerId=undefined Requested by Host: amplify.outbrain.com URL: https://amplify.outbrain.com/cp/obtp.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 70.42.32.95 , United States, ASN22075 (AS-OUTBRAIN, US), Reverse DNS ny.outbrain.com Software / Resource Hash 1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:05:33 GMT X-TraceId 58043209bc6c2cf3915d183e26fe5d37 Content-Length 35 Content-Type application/javascript
GET H/1.1	200 OK	unifiedPixel tr.outbrain.com/	53 B 225 B	470ms 110ms	Image image/gif	70.42.32.95 AS-OUTBRAIN
General Check archive.org Show headers Download Go to Show image Full URL https://tr.outbrain.com/unifiedPixel?marketerId=00d61f3947fbcca6a300f9bcb5900fda25&obApiVersion=1.1&obtpVersion=2.0.5&name=PAGE_VIEW&dl=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&g=1&optOut=false&bust=03075119183127548&referrer= Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 70.42.32.95 , United States, ASN22075 (AS-OUTBRAIN, US), Reverse DNS ny.outbrain.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:05:33 GMT Cache-Control no-cache X-TraceId 9a2da6cd1763011d20277ef66691a86f Content-Length 53 Content-Type image/gif;
GET H/1.1	200 OK	getuidj Show response ib.adnxs.com/	11 B 817 B	137ms 44ms	XHR application/json	185.89.210.20 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.210.20 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Pragma no-cache Date Mon, 20 Feb 2023 03:05:33 GMT AN-X-Request-Uuid fcf961eb-66d6-4f06-a9f5-f71d7c136645 Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://events.splunk.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 80.255.7.100; 80.255.7.100; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	133ms 40ms	Image text/plain	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1642523699107798&ev=PageView&dl=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&rl=&if=false&ts=1676862333650&sw=1600&sh=1200&v=2.9.96&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1676862333649.977638182&it=1676862333507&coo=false&eid=1914583546-12&rqm=GET Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 20 Feb 2023 03:05:33 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	ga-audiences www.google.com/ads/	42 B 408 B	204ms 77ms	Image image/gif	2a00:1450:400d:807::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=2011908932&_u=aCDAiUAjBAAAAEAFK~&z=584569287 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	52ms 51ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=2011908932&_u=aCDAiUAjBAAAAEAFK~&z=584569287 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	400	interact Show response adobedc.demdex.net/ee/v1/	333 B 677 B	197ms 70ms	Fetch application/json	15.236.117.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://adobedc.demdex.net/ee/v1/interact?configId=2ab6666c-0190-4d80-baff-f32a5d133289&requestId=1ad4999b-4863-4fcd-a283-a3a73bd277c6 Requested by Host: cdn1.adoberesources.net URL: https://cdn1.adoberesources.net/alloy/2.6.4/alloy.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.236.117.205 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-236-117-205.eu-west-3.compute.amazonaws.com Software jag / Resource Hash 8ea5a26f8f0cf587e8589baf59437afba49af9c0171440a02ae29694bdcf5746 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers date Mon, 20 Feb 2023 03:05:33 GMT content-encoding deflate x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-rate-limit-remaining 599 x-adobe-edge IRL1;6 x-xss-protection 1; mode=block x-request-id 1ad4999b-4863-4fcd-a283-a3a73bd277c6 server jag vary Origin content-type application/json;charset=utf-8 access-control-allow-origin https://events.splunk.com access-control-expose-headers Retry-After, X-Adobe-Edge, X-Request-ID cache-control no-cache, no-store, max-age=0, no-transform, private access-control-allow-credentials true x-konductor 23.2.17:278f8345
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	238ms 230ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A33%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2020%20Feb%202023%2003%3A05%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22581214e52f923b1a91064a134ca689d7%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2020%20Feb%202023%2003%3A05%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2020%20Feb%202023%2003%3A05%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	226ms 220ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A6%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	visit Show response analytics.vendemore.com/	33 B 381 B	52ms 43ms	XHR text/plain	3.120.63.212 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://analytics.vendemore.com/visit?vlmref=&vaid=&url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&title=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&path=%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022&domain=events.splunk.com&referrer= Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 3.120.63.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-120-63-212.eu-central-1.compute.amazonaws.com Software / Resource Hash 5965386795e9311dfa69e603af755b21526fcc2d5c66ed20e75636f40dcaeb2f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:33 GMT strict-transport-security max-age=31536000; includeSubDomains access-control-max-age 3600 access-control-allow-methods POST, GET, OPTIONS, HEAD content-type text/plain;charset=ISO-8859-1 access-control-allow-origin https://events.splunk.com access-control-allow-credentials true access-control-allow-headers Content-Type content-length 33
POST H2	200	/ Show response www.facebook.com/tr/ Frame A464	0 73 B	41ms 40ms	Document text/plain	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://events.splunk.com Referer https://events.splunk.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://events.splunk.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Mon, 20 Feb 2023 03:05:34 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	up Show response insight.adsrvr.org/track/ Frame B794	0 182 B	181ms 58ms	Document text/html	3.33.220.150 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://insight.adsrvr.org/track/up?adv=65d5w9m&ref=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&upid=zfbopfz&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.33.220.150 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a12b7a488abeaa9e4.awsglobalaccelerator.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://events.splunk.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control private,no-cache, must-revalidate content-type text/html date Mon, 20 Feb 2023 03:05:34 GMT p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" pragma no-cache x-aspnet-version 4.0.30319
GET H2	200	up Show response insight.adsrvr.org/track/ Frame EC49	0 181 B	168ms 58ms	Document text/html	3.33.220.150 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://insight.adsrvr.org/track/up?adv=t0q4wl6&ref=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&upid=afx4zne&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.33.220.150 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a12b7a488abeaa9e4.awsglobalaccelerator.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://events.splunk.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control private,no-cache, must-revalidate content-type text/html date Mon, 20 Feb 2023 03:05:34 GMT p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" pragma no-cache x-aspnet-version 4.0.30319
GET H2	200	analytics.bundle.js Show response v2.listenloop.com/	98 KB 33 KB	150ms 49ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://v2.listenloop.com/analytics.bundle.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f598261aad7af71ac084af1c2a3b66f2539f7c274b78c34b6d2065aeb0ea592 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:34 GMT x-amz-version-id xVLphoLFwqQvrP0ohrfnMeHuimGXKe7s content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-request-id CTYDCAQKST8HHGVD age 5714 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-id-2 BPHRBhim4/tN/4WjH/mTNUcNWqPQYiV/ooCuA2L8kkvpUvqADQyegEe9j+JgMEqEKksQeAyE+Ro= last-modified Wed, 15 Feb 2023 13:38:02 GMT server cloudflare etag W/"4cf7f3b79561ce3e59a4ddf1901017a8" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JhnaNUjkwwzmEggrcf1IRhyH4aYVe7hVkOk9BNMryDvHDaJ34N9T%2Fp1xthdBUi%2Fy%2F%2FY8v%2FNnAEEO77qf6jRxOprm2yT4YE2o1zajDhHcOVUiCyIv8PYyP4kDMn%2BMsjLy6odpHVpPzLhxj%2B2WResGlg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-frame-options SAMEORIGIN cache-control max-age=1800 cf-ray 79c405776dcb91f9-FRA
GET H2	200	fs.js Show response edge.fullstory.com/s/	282 KB 82 KB	134ms 40ms	Script application/javascript	35.201.112.186 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://edge.fullstory.com/s/fs.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 186.112.201.35.bc.googleusercontent.com Software UploadServer / Resource Hash ad339b9c312c44b3ad52e8fac0db277aa6d7cf7f0b2533f51a635ffa483c9391 Request headers Referer https://events.splunk.com/ Origin https://events.splunk.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 02:49:53 GMT content-encoding br age 941 x-guploader-uploadid ADPycdtWyJxWE2psSDXd_v3nZyFant06a6fKoNmV2QB3tvalv2eYWJfzytebBKhk8BAV4N71QMnrzngP-CHWxbSYdkzG3g3gmqid x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 83160 last-modified Tue, 14 Feb 2023 14:21:34 GMT server UploadServer etag W/"4c17080f3a17f0f7f99e528d29a173f1" vary Accept-Encoding x-goog-generation 1676384494771175 x-goog-hash crc32c=5Roe4g==, md5=TBcIDzoX8Pf5nlKNKaFz8Q== access-control-allow-origin * access-control-expose-headers Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace cache-control public, max-age=3600 x-goog-stored-content-length 289137 accept-ranges none content-type application/javascript expires Mon, 20 Feb 2023 03:49:53 GMT
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/	2 KB 1 KB	351ms 277ms	Script application/javascript	2600:9000:2261:a400:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2261:a400:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash f00f72ccdaf681afa6287cd2a5c3fb03be2f1a18719d9c28d7e3c866b1028b60 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:34 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 e94bd6405e7651c50e73077af1691486.cloudfront.net (CloudFront) server envoy x-amz-cf-pop TXL50-P4 etag W/"254eb93a11057ef71ea1a141b8350723" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript;charset=utf-8 cache-control private, max-age=600 x-amz-cf-id fdvp2Bs5WEl7QPY11QtwH6fF-CKTijht3MU5HA50aj71xuf_0RSTlQ==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	239ms 239ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A33%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:34 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	202	page Show response rs.fullstory.com/rec/	74 B 282 B	267ms 171ms	XHR text/plain	35.186.194.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rs.fullstory.com/rec/page Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 58.194.186.35.bc.googleusercontent.com Software / Resource Hash f0d06baac7c6236016333e8e5914e963292ab67deb07a5bd3d12d1d6f2ca69b7 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers date Mon, 20 Feb 2023 03:05:34 GMT via 1.1 google x-content-type-options nosniff content-type text/plain; charset=utf-8 access-control-allow-origin https://events.splunk.com access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 74
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/	0 29 B	397ms 277ms	Script application/javascript	18.134.250.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.134.250.23 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-250-23.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:34 GMT cache-control private, max-age=600 x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/	168 KB 45 KB	350ms 230ms	Script application/javascript	18.134.250.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4d6500cee7e1a0c3ef62fdbbc545c17d/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.134.250.23 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-250-23.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash f37ee08b25f3894e9c1f322a86515d477a32cf36dadffb6b7f05a0ec23a17d81 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:34 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control private, max-age=600
GET H2	204	unip Show response trc-events.taboola.com/1341559/log/3/	0 248 B	238ms 42ms	XHR text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Full URL https://trc-events.taboola.com/1341559/log/3/unip?en=pre_d_eng_tb&tos=1555&scd=0&ssd=1&est=1676862333443&ver=36&isls=true&src=i&invt=1500&msa=1035&rv=1&tim=1676862334999&vi=1676862333440&ri=79e9267b6eb604f0bf3f276c3eedf65d&ref=null&cv=20230219-9-RELEASE&item-url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&ler=other Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers access-control-allow-origin https://events.splunk.com pragma no-cache date Mon, 20 Feb 2023 03:05:35 GMT cache-control no-cache access-control-allow-credentials true server nginx p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	317ms 209ms	XHR application/json	18.135.18.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.135.18.21 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-135-18-21.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers date Mon, 20 Feb 2023 03:05:35 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin https://events.splunk.com content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://api.segment.io https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self'; img-src 'self' data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; access-control-allow-credentials true access-control-allow-headers Authorization, API-Version, Content-Type
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	242ms 242ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:35 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	260ms 259ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A35%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:36 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	228ms 228ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A36%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:37 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	204	unip Show response trc-events.taboola.com/1341559/log/3/	0 247 B	43ms 43ms	XHR text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Full URL https://trc-events.taboola.com/1341559/log/3/unip?en=pre_d_eng_tb&tos=4557&scd=0&ssd=1&est=1676862333443&ver=36&isls=true&src=i&invt=3000&msa=1035&rv=1&tim=1676862338000&vi=1676862333440&ri=79e9267b6eb604f0bf3f276c3eedf65d&ref=null&cv=20230219-9-RELEASE&item-url=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&ler=other Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers access-control-allow-origin https://events.splunk.com pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT cache-control no-cache access-control-allow-credentials true server nginx p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	156ms 47ms	Script application/javascript	199.232.16.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.16.157 Vienna, Austria, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:38 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 16:56:53 GMT etag "32ad004436155ec972bc50e6238b5b67+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15375 x-served-by cache-iad-kjyo7100081-IAD, cache-vie6383-VIE
GET H2	200	FQgOcAAM.min.js Show response scripts.demandbase.com/	70 KB 19 KB	128ms 36ms	Script application/javascript	18.64.79.118 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/FQgOcAAM.min.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-118.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash b3e4d2a082425e704d6d407c38cb401eebc267685ad78c21daa627191d3005a1 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-amz-version-id 9mPKCHaRKL1MFtloX0gF3xpHvn_nFGRS content-encoding gzip via 1.1 f03ada864fbb3bc735df571a1aa182ec.cloudfront.net (CloudFront) date Mon, 20 Feb 2023 03:01:33 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-amz-cf-pop TXL50-P2 age 3473 x-cache Hit from cloudfront last-modified Fri, 03 Feb 2023 22:43:07 GMT server AmazonS3 etag W/"a0d8db4a592bfddceaa8612199421f56" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control public, max-age=3600 permissions-policy accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=() x-amz-cf-id 1GN43BahN6bJ2oooGg5OcdwpSkZBPlvDGhWlGhfkS_u8VrVBDO_ZVA==
GET H2	200	amzn.js Show response c.amazon-adsystem.com/aat/	7 KB 7 KB	111ms 30ms	Script text/javascript	18.64.83.82 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/aat/amzn.js Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.83.82 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-83-82.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash 45153d776213fa86c1ef7dca51e36d669e1b697b53907f3bf7cd3ee706edbaec Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-amz-version-id RCjAxJ8CrRqbtKQCS4KIrWhcLcYrBklc date Sun, 19 Feb 2023 04:46:32 GMT via 1.1 64ff1e6af494771d4212cf7d4543447e.cloudfront.net (CloudFront) last-modified Thu, 11 Nov 2021 17:52:19 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 age 80351 etag "4e42700e21a922978b72507ad18a7fea" x-cache Hit from cloudfront content-type text/javascript accept-ranges bytes content-length 6674 x-amz-cf-id D6meIOpS3N9TLm3KJpfRpPRjYIEA2Y19kKcNXtLtSmleMKBUrnlDdg==
GET H2	200	iztag.js Show response tags.inzynk.io/dji5wmjz/	17 KB 18 KB	116ms 35ms	Script application/octet-stream	2600:9000:2260:6800:12:dfa9:e200:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tags.inzynk.io/dji5wmjz/iztag.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TPV7TP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2260:6800:12:dfa9:e200:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 7c2783718baefb66f7810aedae99e6bbabd3713e0f6098079f6ff9b4d1433bc2 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Sun, 19 Feb 2023 07:47:04 GMT via 1.1 f75621cd6e47ae7d0a4d07cd1877339c.cloudfront.net (CloudFront) last-modified Wed, 25 May 2022 10:03:10 GMT server AmazonS3 x-amz-cf-pop TXL50-P3 age 69515 etag "382804949496b421c76a3504a7676727" x-cache Hit from cloudfront content-type application/octet-stream accept-ranges bytes content-length 17723 x-amz-cf-id J-75BYcKAtk09jlUEZUAqGcY_8h1nRhfk5UH7DBRRpP8dm9qBHkpXQ==
GET H2	204	26b58e1d9d1d.js Show response w.usabilla.com/ Frame 32CB	0 91 B	207ms 76ms	Script text/plain	52.16.64.51 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://w.usabilla.com/26b58e1d9d1d.js?lv=1 Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.16.64.51 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-16-64-51.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT cache-control public, max-age=60 x-widget-server 2.1
GET H/1.1	200 OK	iu3 Show response s.amazon-adsystem.com/ Frame 0E6B Redirect Chain https://s.amazon-adsystem.com/iu3?pid=3fcbe918-6424-4b3d-95aa-68d72d53fbd1&event=PageView&ts=1676862338066 https://s.amazon-adsystem.com/iu3?pid=3fcbe918-6424-4b3d-95aa-68d72d53fbd1&event=PageView&ts=1676862338066&dcc=t	65 B 896 B	138ms 137ms	Document text/html	52.46.128.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.amazon-adsystem.com/iu3?pid=3fcbe918-6424-4b3d-95aa-68d72d53fbd1&event=PageView&ts=1676862338066&dcc=t Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aat/amzn.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 115d83ece49fd1c5769409aab9d78572eed86cd38a0556b4cdeeac82c83091d3 Security Headers Name Value Strict-Transport-Security max-age=47474747; includeSubDomains; preload Request headers Referer https://events.splunk.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Connection keep-alive Content-Length 65 Content-Type text/html;charset=ISO-8859-1 Date Mon, 20 Feb 2023 03:05:38 GMT Expires Thu, 01 Jan 1970 00:00:00 GMT Pragma no-cache Server Server Strict-Transport-Security max-age=47474747; includeSubDomains; preload Vary Content-Type,Accept-Encoding,User-Agent p3p policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" x-amz-rid EA9FWW28R4RWKWBSE8H7 Redirect headers Cache-Control max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Connection keep-alive Content-Length 0 Date Mon, 20 Feb 2023 03:05:38 GMT Expires Thu, 01 Jan 1970 00:00:00 GMT Location https://s.amazon-adsystem.com/iu3?pid=3fcbe918-6424-4b3d-95aa-68d72d53fbd1&event=PageView&ts=1676862338066&dcc=t Pragma no-cache Server Server Strict-Transport-Security max-age=47474747; includeSubDomains; preload Vary Content-Type,Accept-Encoding,User-Agent p3p policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR" x-amz-rid RF1Y10YZR5NX64Y90SDT
GET H2	200	dji5wmjz Show response analytics.inzynk.io/collect/	171 B 441 B	314ms 82ms	Script text/plain	13.49.79.244 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://analytics.inzynk.io/collect/dji5wmjz?izcid=&iztid=&u=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&t=Security+with+SURGe%3A+Analysis+of+10+Major+Ransomware+Strains+%7C+Virtual+Event+%7C+Splunk&p=%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022&d=events.splunk.com&r= Requested by Host: tags.inzynk.io URL: https://tags.inzynk.io/dji5wmjz/iztag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.49.79.244 Stockholm, Sweden, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-49-79-244.eu-north-1.compute.amazonaws.com Software nginx/1.18.0 / Resource Hash ca62366168843b5a50c898efddc7cf585457ef0bdde2177af38f05dea6dd01b4 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:38 GMT server nginx/1.18.0 content-length 171 vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers content-type text/plain;charset=ISO-8859-1
GET H2	451	464526.gif id.rlcdn.com/	0 98 B	138ms 48ms	Image text/plain	35.244.174.68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://id.rlcdn.com/464526.gif Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 68.174.244.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:38 GMT via 1.1 google alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
POST H2	200	ip.json Show response api.company-target.com/api/v2/	447 B 935 B	176ms 100ms	XHR application/json	18.64.79.84 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&page_title=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.84 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-84.txl50.r.cloudfront.net Software nginx / Resource Hash 2ba4a6b1ebfb80728d3b65bfa635d53207ea54977db48861f4b81cec562f8458 Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Mon, 20 Feb 2023 03:05:38 GMT identification-source CENTRAL content-encoding gzip via 1.1 0f55386ae5e307100f1e7694cff2d5d8.cloudfront.net (CloudFront) x-amz-cf-pop TXL50-P2 x-cache Miss from cloudfront request-id 776b6d77-eb56-4645-a335-0b1ee4712894 pragma no-cache server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 access-control-allow-origin https://events.splunk.com access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true vary Accept-Encoding, Origin api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id fgldQHuvHLOiJnzuxZ1HxoUAtzXI4AxeJvixp3tvJWCKcYkUsbfqTQ== expires Sun, 19 Feb 2023 03:05:38 GMT
GET H2	200	adsct t.co/i/	43 B 378 B	239ms 150ms	Image image/gif	104.244.42.5 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=60847b48-c257-4204-a4a7-46a03166bb29&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=e92174af-02c9-4a4a-88f0-9c09a5e52ce8&tw_document_href=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nvbvz&type=javascript&version=2.3.29 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-response-time 110 date Mon, 20 Feb 2023 03:05:37 GMT strict-transport-security max-age=0 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 0b9245f6f7dcc2cd cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 0ae18058e75918fa0eac4d49b3f69d5ca5ef8177a044bbca85593cbd5c28d849 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 394 B	247ms 152ms	Image image/gif	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=60847b48-c257-4204-a4a7-46a03166bb29&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=e92174af-02c9-4a4a-88f0-9c09a5e52ce8&tw_document_href=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nvbvz&type=javascript&version=2.3.29 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-response-time 112 date Mon, 20 Feb 2023 03:05:37 GMT strict-transport-security max-age=631138519 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 55e32e2101507e59 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 1a2edb6a339d84c3ef57c15a436f8610f70a52797cf5d6055793c1c59b131698 content-length 43
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	76ms 76ms	XHR text/plain	2a00:1450:400d:806::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j99&a=2009442898&t=event&ni=1&_s=1&dl=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&dr=%2F&dp=%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&ul=en-us&de=UTF-8&dt=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=demandbase&ea=demandbase%20loaded&el=%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&_u=aDDACUAjBAAAAGAFK~&jid=1901921024&gjid=1372323004&cid=1675861238.1676862333&tid=UA-399680-1&_gid=1891073734.1676862334&_r=1&gtm=45He32f0n71TPV7TP&cd3=1675861238.1676862333&cd4=1676862338414.xk1sef3c&cd5=2023-02-20T03%3A05%3A38.414%2B00%3A00&cd36=GA1.1.1675861238.1676862333&cd45=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F110.0.5481.100%20Safari%2F537.36&cd7=Bot&cd8=(Non-Company%20Visitor)&cd26=&z=227698899 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 70 B	50ms 49ms	XHR text/plain	2a00:1450:4025:402::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=1901921024&gjid=1372323004&_gid=1891073734.1676862334&_u=aDDACUAjBAAAAGAFK~&z=1117621580 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4025:402::9c Den Helder, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	78ms 77ms	Image image/gif	2a00:1450:400d:807::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=1901921024&_u=aDDACUAjBAAAAGAFK~&z=1594741028 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	54ms 53ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=1901921024&_u=aDDACUAjBAAAAGAFK~&z=1594741028 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 70 B	48ms 48ms	XHR text/plain	2a00:1450:4025:402::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=1901921024&gjid=1372323004&_gid=1891073734.1676862334&_u=aDDACUAjBAAAAGAFK~&z=1800762263 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4025:402::9c Den Helder, Netherlands, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	104ms 103ms	Image image/gif	2a00:1450:400d:807::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=1901921024&_u=aDDACUAjBAAAAGAFK~&z=265187947 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	52ms 51ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-399680-1&cid=1675861238.1676862333&jid=1901921024&_u=aDDACUAjBAAAAGAFK~&z=265187947 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	233ms 232ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A37%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:38 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	collect Show response sgtm.splunk.com/g/	65 B 127 B	180ms 179ms	XHR text/plain	2600:1901:0:a57b:: GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sgtm.splunk.com/g/collect?v=2&tid=G-5EPM2P39FV&gtm=45je32f0&_p=2009442898&cid=1675861238.1676862333&ul=en-us&sr=1600x1200&_fplc=0&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&sst.uc=DE&_s=2&sid=1676862333&sct=1&seg=0&dl=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&dt=Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk&en=demandbase_loaded&ep.cookieDomain=auto&ep.allowLinker=true&ep.gtm_tag_name=sGTM%20-%20GA4%20-%20Global%20Demandbase%20Tag&ep.gtm_settings=GTM-TPV7TP%20%7C%20593%20%7C%20&ep.hit_timestamp=2023-02-20T03%3A05%3A38.421%2B00%3A00&_et=5000&up.demandbase_audience=Bot&up.demandbase_company_name=(Non-Company%20Visitor)&up.demandbase_audience_segment=&up.custom_client_id=GA1.2.1675861238.1676862333&richsstsse Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:a57b:: Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:39 GMT via 1.1 google x-content-type-options nosniff server Google Frontend content-type text/plain access-control-allow-origin https://events.splunk.com cache-control no-cache access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-accel-buffering no
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	226ms 226ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A38%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:39 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	analytics_data Show response abm2.listenloop.com/api/v1/public/	19 B 763 B	569ms 122ms	Fetch application/json	52.45.207.127
General Check archive.org Show headers Download Go to Full URL https://abm2.listenloop.com/api/v1/public/analytics_data?public_key=JRsJMiSyunHf8gYEStaz Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.45.207.127 -, , ASN (), Reverse DNS Software nginx / Resource Hash 54c92804a5f97113030e5307876352f27f1623775916b78311a3131a6bf89fab Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:05:40 GMT Content-Encoding gzip Connection keep-alive Content-Length 45 X-Request-Id 8d3da568-263c-4ba6-9e6e-d9f2d09a3399 Pragma no-cache X-Runtime 0.003780 Server nginx ETag W/"f1c01ba10a22040f7bda8645ceb66ed2" Vary Accept-Encoding Access-Control-Allow-Methods GET,POST,DELETE,PUT,PATCH,OPTIONS,HEAD Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://events.splunk.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Access-Control-Allow-Headers Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Authorization
POST H2	200	analytics Show response pt37ad6f6a.execute-api.us-east-1.amazonaws.com/Prod/v1/	47 B 480 B	329ms 328ms	Fetch application/json	65.9.66.7
General Check archive.org Show headers Download Go to Full URL https://pt37ad6f6a.execute-api.us-east-1.amazonaws.com/Prod/v1/analytics Requested by Host: events.splunk.com URL: https://events.splunk.com/Security-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022?utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware&LST=Email3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.66.7 -, , ASN (), Reverse DNS Software / Resource Hash c4ceeced1b9b4a9f07af56e839b724635e017c95609fde67f58d736d65fffd93 Request headers Referer https://events.splunk.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type application/json Response headers date Mon, 20 Feb 2023 03:05:40 GMT via 1.1 58c21e16c9e093deb494fbb4de260efa.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C1 x-amzn-requestid e0c95ceb-992a-4710-8b40-e259bd395405 x-amzn-trace-id Root=1-63f2e384-0ef3526905dac34e2feb3dfc;Sampled=1 access-control-allow-methods OPTIONS,POST content-type application/json access-control-allow-origin * x-cache Miss from cloudfront x-amz-apigw-id Anh80HrtoAMFo0w= content-length 47 x-amz-cf-id lKC-aDFCWxbZTMCUx4wITOAYuVyadJiUzKJWN7Iyyn0TDPJBzLsDdg== access-control-allow-headers Content-Type
OPTIONS H2	200	analytics pt37ad6f6a.execute-api.us-east-1.amazonaws.com/Prod/v1/ Frame	0 0	419ms 313ms	Preflight application/json	65.9.66.7
General Check archive.org Show headers Download Go to Full URL https://pt37ad6f6a.execute-api.us-east-1.amazonaws.com/Prod/v1/analytics Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.66.7 -, , ASN (), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://events.splunk.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin * content-length 0 content-type application/json date Mon, 20 Feb 2023 03:05:40 GMT via 1.1 58c21e16c9e093deb494fbb4de260efa.cloudfront.net (CloudFront) x-amz-apigw-id Anh8xEEDoAMFhBg= x-amz-cf-id GX2-CnARBjO489k49nQguLr1ZxC45N6YABfxTUcy3dKOsKOmJNYmCw== x-amz-cf-pop FRA56-C1 x-amzn-requestid ace250df-507b-4c63-9706-513425826c1a x-cache Miss from cloudfront
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	227ms 226ms	Image image/gif	104.109.89.85 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=581214e52f923b1a91064a134ca689d7&svisitor=null&visitor=cbdf86d2-59c5-4717-80d2-2cca360a5ae3&session=5117c711-8f67-48f3-8c36-7610bb1564ba&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2020%20Feb%202023%2003%3A05%3A39%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Splunk%20SURGe%20recently%20analyzed%20how%20quickly%20ten%20major%20ransomware%20strains%2C%20including%20Lockbit%2C%20REvil%20and%20Blackmatter%2C%20could%20encrypt%20100%2C000%20files.%20While%20security%20teams%20focus%20on%20mitigation%20and%20response%20when%20it%20comes%20to%20ransomware%20infections%2C%20the%20encryption%20speeds%20discovered%20in%20this%20research%20indicate%20that%20if%20an%20enterprise%20is%20hit%20with%20a%20ransomware%20attack%2C%20it%20may%20be%20too%20late%20to%20stop%20it%20from%20spreading.%22%2C%22keywords%22%3A%22Security%2C%20Ransomware%2C%20Threats%2C%20Ransomware%20Strains%2C%20Encryption%20Speed%2C%20Mitigation%2C%20Response%2C%20Security%20Attacks%22%2C%22title%22%3A%22Security%20with%20SURGe%3A%20Analysis%20of%2010%20Major%20Ransomware%20Strains%20%7C%20Virtual%20Event%20%7C%20Splunk%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fevents.splunk.com%2FSecurity-with-SURGe-Analysis-of-10-Major-Ransomware-Strains-June2022%3Futm_medium%3Demail%26utm_source%3Dsplunk%26utm_campaign%3DFY23Q2_DGN_APAC_WBR_SEC_EN_JMa_SURGe_Ransomware%26LST%3DEmail3&pageViewId=afb5c2ce-317b-4397-8840-705ae0c6417d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.89.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-89-85.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://events.splunk.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:05:40 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT