therecord.media Open in urlscan Pro
2606:4700::6812:621 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/z9xWApU9G1
Effective URL:
https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
Submission: On December 29 via api (December 29th 2021, 2:35:00 pm UTC) from US — Scanned from DE

Summary HTTP 71 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 21 IPs in 5 countries across 17 domains to perform 71 HTTP transactions. The main IP is 2606:4700::6812:621, located in United States and belongs to CLOUDFLARENET, US. The main domain is therecord.media.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2021. Valid for: a year.

This is the only time therecord.media was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
28	2606:4700::68... 2606:4700::6812:621	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:d4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.18.12.124 104.18.12.124	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:215... 2600:9000:2156:ce00:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:46b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e9cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:14bf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	104.111.233.140 104.111.233.140	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	35.71.162.228 35.71.162.228	16509 (AMAZON-02) (AMAZON-02)
1	185.33.220.240 185.33.220.240	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2c40::c7... 2606:2c40::c73c:67fe	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
71	21

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2606:4700::6812:621 (United States)

ASN13335 (CLOUDFLARENET, US)

therecord.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.12.124 (None, )

ASN13335 (CLOUDFLARENET, US)

www.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2156:ce00:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:46b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e9cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:14bf (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.111.233.140 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-233-140.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.162.228 (United States)

ASN16509 (AMAZON-02, US)
PTR: a8b6f710f441cdbc2.awsglobalaccelerator.com

recordedfuture.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.220.240 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2c40::c73c:67fe (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

go.recordedfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	therecord.media therecord.media	539 KB
10	6sc.co j.6sc.co c.6sc.co b.6sc.co	16 KB
4	matomo.cloud cdn.matomo.cloud recordedfuture.matomo.cloud	65 KB
4	recordedfuture.com www.recordedfuture.com go.recordedfuture.com	402 KB
4	cloudflare.com cdnjs.cloudflare.com	21 KB
3	hubspot.com track.hubspot.com forms.hubspot.com	4 KB
3	jsdelivr.net cdn.jsdelivr.net	29 KB
2	youtube.com www.youtube.com	50 KB
2	google-analytics.com www.google-analytics.com	20 KB
2	hs-scripts.com js.hs-scripts.com	1 KB
2	googletagmanager.com www.googletagmanager.com	69 KB
1	adnxs.com secure.adnxs.com	689 B
1	gravatar.com secure.gravatar.com	3 KB
1	hs-banner.com js.hs-banner.com	16 KB
1	hsleadflows.net js.hsleadflows.net	87 KB
1	hs-analytics.net js.hs-analytics.net	20 KB
1	t.co t.co	650 B
71	17

	Domain	Requested by
28	therecord.media	t.co therecord.media
8	b.6sc.co
4	cdnjs.cloudflare.com	therecord.media cdn.matomo.cloud
3	www.recordedfuture.com	therecord.media
3	cdn.jsdelivr.net	therecord.media cdn.matomo.cloud
2	track.hubspot.com
2	recordedfuture.matomo.cloud	cdn.matomo.cloud
2	www.youtube.com	therecord.media www.youtube.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	cdn.matomo.cloud	t.co
2	js.hs-scripts.com	therecord.media www.googletagmanager.com
2	www.googletagmanager.com	therecord.media t.co
1	go.recordedfuture.com
1	forms.hubspot.com	js.hsleadflows.net
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	secure.gravatar.com
1	j.6sc.co	t.co
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	t.co
71	22

This site contains links to these domains. Also see Links.

Domain
www.recordedfuture.com
twitter.com
www.linkedin.com
www.facebook.com
www.reddit.com
news.ycombinator.com
www.techmeme.com
www.cisa.gov
www.instagram.com

Subject Issuer	Validity	Valid
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-18` - `2022-07-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.recordedfuture.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-23` - `2022-02-22`	a year	crt.sh
cdn.matomo.cloud Amazon	`2021-12-28` - `2023-01-25`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2021-03-09` - `2022-03-16`	a year	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.matomo.cloud Amazon	`2021-08-20` - `2022-09-18`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2021-06-26` - `2022-06-25`	a year	crt.sh
go.recordedfuture.com Cloudflare Inc ECC CA-3	`2021-07-16` - `2022-07-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
Frame ID: 846E892BA355EBAC9794F2D8945194A0
Requests: 71 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Iranian hackers behind Cox Media Group ransomware attack - The Record by Recorded Future

Page URL History Show full URLs

https://t.co/z9xWApU9G1 Page URL
https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Osano (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cookieconsent\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

71
Requests

99 %
HTTPS

75 %
IPv6

17
Domains

22
Subdomains

21
IPs

5
Countries

1343 kB
Transfer

3251 kB
Size

25
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.recordedfuture.com/privacy-policy/
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/&text=Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/&title=Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/&title=Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/submitlink?u=https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/&t=Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack

Search URL Search Domain Scan URL

URL: https://www.techmeme.com/211119/p20#a211119p20
Title: Lee Enterprises

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/uscert/ncas/alerts/AA18-337A
Title: SamSam

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/are-ransomware-attacks-slowing-down/?__hstc=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&__hssc=156209188.1.1640788492047&__hsfp=1433769858
Title: Are Ransomware Attacks Slowing Down? It Depends on Where You Look

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/fin7-recruits-talent-push-ransomware/?__hstc=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&__hssc=156209188.1.1640788492047&__hsfp=1433769858
Title: FIN7 Recruits Talent for Push into Ransomware

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/podcast-episode-228/?__hstc=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&__hssc=156209188.1.1640788492047&__hsfp=1433769858
Title: Ransomware Remains a Serious Threat

Search URL Search Domain Scan URL

URL: https://twitter.com/TheRecord_Media

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/the-record-by-recorded-future

Search URL Search Domain Scan URL

URL: https://www.instagram.com/therecord_media/

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/privacy-policy/?__hstc=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&__hssc=156209188.1.1640788492047&__hsfp=1433769858
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/z9xWApU9G1 Page URL
https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

71 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 z9xWApU9G1
t.co/ 399 B
650 B 144ms
129ms Document
text/html 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/z9xWApU9G1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 29 Dec 2021 14:34:50 GMT
vary: Origin
server: tsa_o
expires: Wed, 29 Dec 2021 14:39:50 GMT
content-type: text/html; charset=utf-8
cache-control: private,max-age=300
content-length: 215
content-encoding: gzip
x-xss-protection: 0
strict-transport-security: max-age=0
x-response-time: 123
x-connection-hash: c03530f0487f5bcd5ae568e26e86afd8adc6ac5c7ba0b8b8c23415dcbec41432

GET
H2 200 Primary Request / Show response
therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/ 58 KB
13 KB 578ms
540ms Document
text/html 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Requested by

Host: t.co
URL: https://t.co/z9xWApU9G1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57ed6e420d993538f3888941403c63f4358b7fc8d9215eae2cd90bc4e12291a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://t.co/

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-type: text/html; charset=UTF-8
cache-control: public, max-age=600
link: <https://therecord.media/?p=10206>; rel=shortlink
strict-transport-security: max-age=31536000; includeSubDomains
x-pantheon-styx-hostname: styx-fe2-a-5477446c7c-czgrj
x-pingback: https://therecord.media/xmlrpc.php
x-styx-req-id: 7b354b5d-68b4-11ec-97cf-361b81a4fdbb
x-served-by: cache-mdw17333-MDW, cache-iad-kiad7000051-IAD
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1640788491.196938,VS0,VE290
vary: Accept-Encoding, Cookie, Cookie
age: 0
via: 1.1 varnish, 1.1 varnish
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6c53c0657bf0dfe3-FRA
content-encoding: br

GET
H2 200 style.min.css
therecord.media/wp-includes/css/dist/block-library/ 79 KB
11 KB 27ms
26ms Stylesheet
text/css 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-mswhl
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17345-MDW, cache-wdc5561-WDC
last-modified: Mon, 15 Nov 2021 13:38:48 GMT
server: cloudflare
x-timer: S1636988800.774845,VS0,VE1
etag: W/"619262e8-13abe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 8efd5cb3-4625-11ec-94ad-96febdd7e5e5
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068e8c7dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 rf-rss-widget.css
therecord.media/wp-content/plugins/rf-rss-feed/public/css/ 473 B
519 B 27ms
25ms Stylesheet
text/css 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/rf-rss-feed/public/css/rf-rss-widget.css?ver=5.8.2

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77e8232dee29ca904e5726f29b02f784c6155de5e388e61570a74aedf61b69de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=944
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-9ssm9
x-cache: MISS, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17349-MDW, cache-wdc5535-WDC
last-modified: Mon, 15 Nov 2021 13:38:47 GMT
server: cloudflare
x-timer: S1636988800.798352,VS0,VE1
etag: W/"619262e7-3b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 8f008790-4625-11ec-811f-062b5d80bfed
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068e8c9dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 jquery.mCustomScrollbar.min.css
cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/ 42 KB
4 KB 35ms
17ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/jquery.mCustomScrollbar.min.css?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

247184981eb6f698a94e431a83d68c6b0df623cce57b6e29dc5a6c11e23aa195

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1177610
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3359
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:12:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed4-a757"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lFL%2BdRZjIc7CERdos4PkRY3e7E9aw56sZaHgk08ipntVnCSdY0LP2edlGmDaemFsWqFvvHxdcHLpAVRj97%2FebHs0gTcE3A0ak8NABYSaTU37gRtumdCDStUpJoAmxoq%2FCUfVPKsDeTvp3oL2MuuLkMy6"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6c53c0690cc94e98-FRA
expires: Mon, 19 Dec 2022 14:34:51 GMT

GET
H2 200 jquery.fancybox.min.css
cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/ 12 KB
4 KB 33ms
15ms Stylesheet
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.css?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5593678
x-jsd-version: 3.5.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19144-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"31fb-G+m3m+AqHPxdlsSl4P649HK6vZU"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6c53c0690a198b8d-FRA

GET
H2 200 style-v4.css
therecord.media/wp-content/themes/therecordmedia/assets/css/ 345 KB
48 KB 59ms
58ms Stylesheet
text/css 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b31a805b14cdf1311a94debe97e7d5695f38eca4dddc65d98cb58e9c281cf36d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=459099
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-jl55h
x-cache: HIT, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17346-MDW, cache-wdc5529-WDC
last-modified: Mon, 15 Nov 2021 13:38:48 GMT
server: cloudflare
x-timer: S1636988800.759334,VS0,VE1
etag: W/"619262e8-7015b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 8efc07d4-4625-11ec-8e4f-72b5c3456d69
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068f8cadfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 custom-v8.css
therecord.media/wp-content/themes/therecordmedia/assets/css/ 6 KB
1 KB 77ms
76ms Stylesheet
text/css 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/css/custom-v8.css?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a01127152b090004aa159e0d56664e2268a1de5334ba6d9d6515388a0f53a3b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=7291
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-vqjk6
x-cache: HIT, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17368-MDW, cache-wdc5545-WDC
last-modified: Mon, 15 Nov 2021 13:38:48 GMT
server: cloudflare
x-timer: S1636988800.764302,VS0,VE1
etag: W/"619262e8-1c7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 8f01a51d-4625-11ec-8937-3a0169694d83
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068f8ccdfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 ytprefs.min.css
therecord.media/wp-content/plugins/youtube-embed-plus/styles/ 8 KB
2 KB 67ms
67ms Stylesheet
text/css 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/youtube-embed-plus/styles/ytprefs.min.css?ver=14.0

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b6d59899727d24e2745e5f285811ab052169fce05487c35ab8b8ba11487b63c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-mswhl
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17333-MDW, cache-wdc5546-WDC
last-modified: Sun, 14 Nov 2021 18:40:01 GMT
server: cloudflare
x-timer: S1636988800.782033,VS0,VE0
etag: W/"61915801-1e12"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 8f0129a2-4625-11ec-94ad-96febdd7e5e5
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068f8d2dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 cookieconsent.min.css
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/css/ 20 KB
4 KB 36ms
36ms Stylesheet
text/css 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/css/cookieconsent.min.css?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21f3f80c9adfdf9070c994d881f2069818a2d409b62834c805a7f17f08c91ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-8zzpg
x-cache: HIT, HIT
content-encoding: br
x-served-by: cache-mdw17373-MDW, cache-bwi5064-BWI
last-modified: Sun, 14 Nov 2021 04:23:24 GMT
server: cloudflare
x-timer: S1636988800.807002,VS0,VE1
etag: W/"61908f3c-519d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-styx-req-id: 8effd658-4625-11ec-952d-b6cb26c9e387
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068f8d3dfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 PrimaryLogo-RGB-Carrot.svg
therecord.media/wp-content/uploads/2021/06/ 5 KB
2 KB 35ms
35ms Image
image/svg+xml 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/06/PrimaryLogo-RGB-Carrot.svg

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6429c09d26d4abed1c51691f17eb89c9c1fedf440964890e2a0fe9801e93e653

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 4138914
x-pantheon-styx-hostname: styx-fe2-a-5f44469ddc-p85k9
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17334-MDW, cache-bwi5076-BWI
last-modified: Mon, 25 Oct 2021 16:39:37 GMT
server: cloudflare
x-timer: S1636649578.893558,VS0,VE1
etag: W/"6176ddc9-1421"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/svg+xml
access-control-allow-origin: *
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c068f8dddfe3-FRA
x-styx-req-id: b3c04006-381c-11ec-8d6c-a6abd588099d
x-cache-hits: 0, 1

GET
H2 200 tv-radio-broadcast.jpg
therecord.media/wp-content/uploads/2021/10/ 190 KB
191 KB 66ms
66ms Image
image/jpeg 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/10/tv-radio-broadcast.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a8cba1e5861ac81c699cbf3afce53b3229b282c9b81f4e4695b6a83500bf7d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 43623
cf-polished: origSize=214177, status=webp_bigger
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-vqjk6
x-cache: MISS, HIT
cf-bgj: imgq:100,h2pri
content-length: 194657
x-served-by: cache-mdw17346-MDW, cache-iad-kjyo7100023-IAD
last-modified: Mon, 25 Oct 2021 16:50:30 GMT
server: cloudflare
x-timer: S1640744868.887076,VS0,VE2
etag: "6176e056-344a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/jpeg
x-styx-req-id: 21296bf7-52e5-11ec-8937-3a0169694d83
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c068f8e0dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 rocket-loader.min.js Show response
therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 19ms
19ms Script
application/javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 20 Dec 2021 18:59:20 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"61c0d288-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=172800, public
strict-transport-security: max-age=31536000; includeSubDomains
cf-ray: 6c53c068f8e6dfe3-FRA
expires: Fri, 31 Dec 2021 14:34:51 GMT

GET
H2 200 complianz.min.js Show response
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/ 40 KB
9 KB 66ms
64ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/complianz.min.js?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

326d6c39524da9a4b3d35286c798b93738a4665b29ce498d5b5df959a3a19012

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-8zzpg
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17381-MDW, cache-wdc5554-WDC
last-modified: Sun, 14 Nov 2021 04:23:24 GMT
server: cloudflare
x-timer: S1636988800.838340,VS0,VE1
etag: W/"61908f3c-9e2d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f00872e-4625-11ec-952d-b6cb26c9e387
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c069191ddfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 postscribe.min.js Show response
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/ 17 KB
6 KB 68ms
65ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/postscribe.min.js?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4e20f53f5ef0ed44b783437aa3f4638a9a56cc4aa29ae83ed9212eb2807052a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 1058104
x-pantheon-styx-hostname: styx-fe2-a-85cc7bb74c-2hspj
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17355-MDW, cache-wdc5569-WDC
last-modified: Sat, 04 Dec 2021 03:09:42 GMT
server: cloudflare
x-timer: S1639730387.487918,VS0,VE1
etag: W/"61aadbf6-45f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 480d30b6-5761-11ec-a325-1efd66d788da
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c0691921dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 cookieconsent.min.js Show response
therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/ 25 KB
8 KB 67ms
64ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/cookieconsent.min.js?ver=5.2.5.1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81dbdd695385ce9e3065e0cf1d8f058169de79244b1d1be4059b527e31d23c77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-d25qg
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17364-MDW, cache-wdc5548-WDC
last-modified: Mon, 15 Nov 2021 13:38:47 GMT
server: cloudflare
x-timer: S1636988800.808505,VS0,VE1
etag: W/"619262e7-6441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f00b04a-4625-11ec-882c-ce125293931c
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c0691940dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 fitvids.min.js Show response
therecord.media/wp-content/plugins/youtube-embed-plus/scripts/ 3 KB
1 KB 70ms
67ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/youtube-embed-plus/scripts/fitvids.min.js?ver=14.0

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8be3a402a3b2ad808402cea111ba3d286239d88e06c8e2969c84f46050dc88a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-8zzpg
x-cache: HIT, HIT
content-encoding: br
x-served-by: cache-mdw17375-MDW, cache-bwi5063-BWI
last-modified: Sun, 14 Nov 2021 13:54:51 GMT
server: cloudflare
x-timer: S1636988800.813314,VS0,VE1
etag: W/"6191152b-c1f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8effbc21-4625-11ec-952d-b6cb26c9e387
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c0691942dfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 main.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 24 KB
7 KB 74ms
71ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/main.js?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13a5d6deee5c86d1c86f8ab010b3dfcab1b0b500590024d8c7a44c279c96d443

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=45161
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-vqjk6
x-cache: MISS, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17322-MDW, cache-bwi5036-BWI
last-modified: Sun, 14 Nov 2021 18:40:01 GMT
server: cloudflare
x-timer: S1636988800.854770,VS0,VE1
etag: W/"61915801-b069"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f00e69f-4625-11ec-8937-3a0169694d83
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c0691943dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 jquery.fancybox.min.js Show response
cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/ 67 KB
22 KB 23ms
20ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.js?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5593678
x-jsd-version: 3.5.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19164-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"10a9d-YYFBLnOWZpbQjh5bEkOlctDyK6Y"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6c53c0691a448b8d-FRA

GET
H2 200 jquery.mCustomScrollbar.min.js Show response
cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/ 39 KB
11 KB 27ms
24ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/jquery.mCustomScrollbar.min.js?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00a1230e22b6af3f9df1348f2cd54dc9dbe026f3a41b9bde3009dcefd1648ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 739240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 10595
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:12:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed4-9cd4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZhY6lsWeUiaMKktvwB3mCuQzIp1kSSEixvgVA6f38pCOboxqNKSDEDuyO5X1l5Hy2Bc7%2Bvwu7rHrdWvct5%2FmqUtx3zA8yPvsdY09HRMyWSg7PNLcPO9QFRhaLnWDYZtgmrzxpy9aotjRJiA4jaqMV9N0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6c53c0691ce84e98-FRA
expires: Mon, 19 Dec 2022 14:34:51 GMT

GET
H2 200 custom-v2.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 828 B
591 B 69ms
66ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/custom-v2.js?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f7b3c1c9a817380967e2d68f41c86b4649b68dba06b37a49dab55bb5c5a6eab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=1551
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-jl55h
x-cache: HIT, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17343-MDW, cache-wdc5539-WDC
last-modified: Sun, 14 Nov 2021 04:23:25 GMT
server: cloudflare
x-timer: S1636988800.843610,VS0,VE1
etag: W/"61908f3d-60f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8eff80e2-4625-11ec-8e4f-72b5c3456d69
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c0691946dfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 bundle.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 276 KB
72 KB 70ms
67ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8df981a2e0d74a44530cfe140f2ce72ad4cb7be724706b7a3cfcb160bd06590f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=525445
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-mswhl
x-cache: MISS, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17366-MDW, cache-wdc5524-WDC
last-modified: Sun, 14 Nov 2021 04:23:25 GMT
server: cloudflare
x-timer: S1636988800.879673,VS0,VE1
etag: W/"61908f3d-80485"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f021eba-4625-11ec-94ad-96febdd7e5e5
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c0691949dfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 39ms
17ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-9153858-16

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2ad4e6985a44bf39fed115e7bfe09d64793fc636cb2588fe9afe8ee9b904c644

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36255
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 29 Dec 2021 14:34:51 GMT

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 1 KB
918 B 93ms
64ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/252628.js
Requested by: Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cbc744238de02ebb66ea4c577a57445866f838e029a48ca7d4d82c1cc76efa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 59
cf-polished: origSize=1482
x-hubspot-correlation-id: 895af15e-ec20-474c-a05c-421c1f703649
last-modified: Wed, 29 Dec 2021 14:33:52 GMT
server: cloudflare
x-trace: 2B1A4BC4866D8D6D1DB21121E09347AF45A212B99B000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://therecord.media
expires: Wed, 29 Dec 2021 14:35:51 GMT
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 6c53c0694d144ea4-FRA
cf-bgj: minify

GET
H2 200 ytprefs.min.js Show response
therecord.media/wp-content/plugins/youtube-embed-plus/scripts/ 11 KB
4 KB 65ms
63ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/plugins/youtube-embed-plus/scripts/ytprefs.min.js?ver=14.0

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce42194a19b1b5cf0191b339629deba1e3441298dc72a3145fe37f65276f09a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-8wd9d
x-cache: HIT, HIT
content-encoding: br
x-served-by: cache-mdw17340-MDW, cache-bwi5036-BWI
last-modified: Sun, 14 Nov 2021 18:40:01 GMT
server: cloudflare
x-timer: S1636988800.837707,VS0,VE1
etag: W/"61915801-2ba6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f01529b-4625-11ec-8f8f-e2b451120909
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c069194adfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 modernizr_2.8.3.js Show response
therecord.media/wp-content/themes/therecordmedia/assets/js/ 15 KB
6 KB 66ms
65ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/js/modernizr_2.8.3.js?ver=2021-06-29_1

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82bfc506040c981ec142b63ec85a43e603310d9b5fac6598c5664a144f3c4e3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
cf-polished: origSize=15506
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-8wd9d
x-cache: HIT, HIT
cf-bgj: minify
content-encoding: br
x-served-by: cache-mdw17331-MDW, cache-wdc5558-WDC
last-modified: Sun, 14 Nov 2021 04:23:25 GMT
server: cloudflare
x-timer: S1636988800.869665,VS0,VE1
etag: W/"61908f3d-3c92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f033763-4625-11ec-8f8f-e2b451120909
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c069194cdfe3-FRA
x-cache-hits: 1, 1

GET
H2 200 jquery-migrate.min.js Show response
therecord.media/wp-includes/js/jquery/ 11 KB
4 KB 66ms
65ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799692
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-8zzpg
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17373-MDW, cache-bwi5072-BWI
last-modified: Sun, 14 Nov 2021 04:23:26 GMT
server: cloudflare
x-timer: S1636988800.867209,VS0,VE1
etag: W/"61908f3e-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8f017d9e-4625-11ec-952d-b6cb26c9e387
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c069194edfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 jquery.min.js Show response
therecord.media/wp-includes/js/jquery/ 87 KB
31 KB 70ms
70ms Script
application/x-javascript 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: therecord.media
URL: https://therecord.media/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 3799691
x-pantheon-styx-hostname: styx-fe2-a-5bffbbcccc-2js64
x-cache: MISS, HIT
content-encoding: br
x-served-by: cache-mdw17373-MDW, cache-bwi5058-BWI
last-modified: Sun, 14 Nov 2021 04:23:26 GMT
server: cloudflare
x-timer: S1636988800.882500,VS0,VE1
etag: W/"61908f3e-15db1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-styx-req-id: 8effef48-4625-11ec-be4d-62a9cd3ae778
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c069194fdfe3-FRA
x-cache-hits: 0, 1

GET
H2 200 icomoon.ttf
therecord.media/wp-content/themes/therecordmedia/assets/fonts/custom/ 4 KB
4 KB 23ms
22ms Font
application/x-font-ttf 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/custom/icomoon.ttf?fiuh6y

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a6db13132ef5e4dc98723529dedf677f84b4993b7db70339cb1de93a910ffce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1
Origin: https://therecord.media
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
cf-cache-status: HIT
age: 4138913
x-pantheon-styx-hostname: styx-fe2-b-6cf4595974-tkn5g
x-cache: MISS, HIT
x-served-by: cache-mdw17367-MDW, cache-wdc5538-WDC
last-modified: Thu, 28 Oct 2021 15:47:40 GMT
server: cloudflare
x-timer: S1636649579.933994,VS0,VE1
etag: W/"617ac61c-107c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-font-ttf
access-control-allow-origin: *
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
cf-ray: 6c53c069899ddfe3-FRA
x-styx-req-id: 0a749615-3812-11ec-8dcb-6ed349c1c73f
x-cache-hits: 0, 1

GET
H2 200 gudea-400-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/ 8 KB
8 KB 26ms
24ms Font
font/woff2 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/gudea-400-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f23ec5c633f64e45cdb8119ea2bd55f81bd2bf4a46131cc6e7aa415024db18f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1
Origin: https://therecord.media
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 4138912
x-pantheon-styx-hostname: styx-fe2-a-5f44469ddc-p85k9
x-cache: MISS, HIT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 7856
x-served-by: cache-mdw17332-MDW, cache-bwi5029-BWI
last-modified: Thu, 28 Oct 2021 15:47:40 GMT
server: cloudflare
x-timer: S1636649579.969897,VS0,VE1
etag: "617ac61c-1eb0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c06989a1dfe3-FRA
x-styx-req-id: 0a6497a0-3812-11ec-8d6c-a6abd588099d
x-cache-hits: 0, 1

GET
H2 200 oswald-400-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/ 24 KB
24 KB 23ms
22ms Font
font/woff2 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/oswald-400-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1010cf08825a41c768a117755a496da61a306c41b83c383ea66f1bb3334bb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1
Origin: https://therecord.media
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 4138913
x-pantheon-styx-hostname: styx-fe2-a-5f44469ddc-p85k9
x-cache: MISS, HIT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 24064
x-served-by: cache-mdw17331-MDW, cache-bwi5064-BWI
last-modified: Thu, 28 Oct 2021 15:47:40 GMT
server: cloudflare
x-timer: S1636649579.930966,VS0,VE1
etag: "617ac61c-5e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c06989a3dfe3-FRA
x-styx-req-id: 56d54f37-381a-11ec-8d6c-a6abd588099d
x-cache-hits: 0, 1

GET
H2 200 oswald-700-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/ 24 KB
24 KB 25ms
25ms Font
font/woff2 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/oswald/oswald-700-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1010cf08825a41c768a117755a496da61a306c41b83c383ea66f1bb3334bb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1
Origin: https://therecord.media
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 4138912
x-pantheon-styx-hostname: styx-fe2-b-75d6cc764-pcbkb
x-cache: MISS, HIT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 24064
x-served-by: cache-mdw17362-MDW, cache-bwi5023-BWI
last-modified: Wed, 10 Nov 2021 18:08:44 GMT
server: cloudflare
x-timer: S1636649579.898603,VS0,VE1
etag: "618c0aac-5e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c06989a7dfe3-FRA
x-styx-req-id: f9476286-42ee-11ec-a363-2eae4f4b1717
x-cache-hits: 0, 1

GET
H2 200 gudea-700-latin.woff2
therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/ 8 KB
8 KB 38ms
37ms Font
font/woff2 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-content/themes/therecordmedia/assets/fonts/gudea/gudea-700-latin.woff2

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3d3367b895674ec706b02be65ae0ee7416f158836f88ddc1d3e469e3bdd6cd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://therecord.media/wp-content/themes/therecordmedia/assets/css/style-v4.css?ver=2021-06-29_1
Origin: https://therecord.media
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 4138913
x-pantheon-styx-hostname: styx-fe2-a-5f44469ddc-2wb7t
x-cache: HIT, HIT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 7932
x-served-by: cache-mdw17347-MDW, cache-bwi5062-BWI
last-modified: Wed, 03 Nov 2021 10:07:31 GMT
server: cloudflare
x-timer: S1636649579.945040,VS0,VE1
etag: "61825f63-1efc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c06989aadfe3-FRA
x-styx-req-id: efe13a52-3d35-11ec-a09e-227203492b43
x-cache-hits: 1, 1

GET
H2 200 are-ransomware-attacks-slowing-down-1024x235.jpg
www.recordedfuture.com/wp-content/uploads/ 45 KB
46 KB 66ms
32ms Image
image/jpeg 104.18.12.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/wp-content/uploads/are-ransomware-attacks-slowing-down-1024x235.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.12.124 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

549e5366744b2259bab7b9d27e121ec7deefd7f527ae7293f22e518f0495e296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 600884
cf-polished: origSize=51257, status=webp_bigger
x-pantheon-styx-hostname: styx-fe2-b-79754f9dc6-vhr7h
x-cache: MISS, HIT
cf-bgj: imgq:100,h2pri
content-length: 46412
x-served-by: cache-mdw17383-MDW, cache-iad-kiad7000071-IAD
last-modified: Mon, 20 Dec 2021 15:33:58 GMT
server: cloudflare
x-timer: S1640187607.999842,VS0,VE1
etag: "61c0a266-c839"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/jpeg
x-styx-req-id: 8e7853fd-61ab-11ec-b7ed-2e2a8b23f283
expires: Wed, 21 Dec 2022 15:43:19 GMT
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c069ff664aa4-FRA
x-cache-hits: 0, 1

GET
H2 200 Main-Feature-1-1024x235.jpg
www.recordedfuture.com/wp-content/uploads/ 51 KB
52 KB 77ms
44ms Image
image/jpeg 104.18.12.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/wp-content/uploads/Main-Feature-1-1024x235.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.12.124 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcf55f419720f33d9092e5769b9a1c1cefd7269e2c19cebb754d4d9257894ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 589337
cf-polished: origSize=58632, status=webp_bigger
x-pantheon-styx-hostname: styx-fe2-a-5477446c7c-6mrjx
x-cache: MISS, HIT
cf-bgj: imgq:100,h2pri
content-length: 52561
x-served-by: cache-mdw17320-MDW, cache-wdc5527-WDC
last-modified: Thu, 21 Oct 2021 12:56:07 GMT
server: cloudflare
x-timer: S1640199155.538363,VS0,VE2
etag: "61716367-e508"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/jpeg
x-styx-req-id: 13236b47-6343-11ec-a49a-eef461bbdb5c
expires: Fri, 23 Dec 2022 16:20:27 GMT
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c069ff684aa4-FRA
x-cache-hits: 0, 1

GET
H2 200 podcast-episode-228-feature-1024x235.png
www.recordedfuture.com/wp-content/uploads/ 112 KB
112 KB 66ms
32ms Image
image/webp 104.18.12.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.recordedfuture.com/wp-content/uploads/podcast-episode-228-feature-1024x235.png

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.12.124 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47735e0d72abf01b03a763a19c6d46804ee6c2f461b7ecb72129c664a8c98d0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
age: 589337
cf-polished: origFmt=png, origSize=172416
x-cache: HIT, HIT
x-cache-hits: 1, 1
content-disposition: inline; filename="podcast-episode-228-feature-1024x235.webp"
cf-bgj: imgq:100,h2pri
content-length: 114466
x-served-by: cache-mdw17369-MDW, cache-iad-kjyo7100160-IAD
last-modified: Mon, 04 Oct 2021 15:34:13 GMT
server: cloudflare
x-timer: S1640199155.734471,VS0,VE6
etag: "615b1ef5-2a180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/webp
x-styx-req-id: 1328c0f2-6343-11ec-8fd2-baa71e14cff3
expires: Fri, 23 Dec 2022 16:20:27 GMT
cache-control: max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c069ff694aa4-FRA
x-pantheon-styx-hostname: styx-fe2-b-79754f9dc6-9hr9h

GET
H2 200 2021_1209-Victim-Data-Released-on-Ransomware-Extortion-Sites-1-1024x607.jpg
therecord.media/wp-content/uploads/2021/12/ 45 KB
45 KB 21ms
20ms Image
image/webp 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/12/2021_1209-Victim-Data-Released-on-Ransomware-Extortion-Sites-1-1024x607.jpg

Requested by

Host: therecord.media
URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9697e2769a5484e3d9086c6f3c97746dff2d88d5c0bd7c5367a020dd5d097ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 1178597
cf-polished: origFmt=jpeg, origSize=56591
x-cache: HIT, HIT
x-cache-hits: 1, 1
content-disposition: inline; filename="2021_1209-Victim-Data-Released-on-Ransomware-Extortion-Sites-1-1024x607.webp"
cf-bgj: imgq:100,h2pri
content-length: 45912
x-served-by: cache-mdw17366-MDW, cache-iad-kiad7000159-IAD
last-modified: Fri, 10 Dec 2021 22:23:57 GMT
server: cloudflare
x-timer: S1639609894.233584,VS0,VE1
etag: "61b3d37d-dd0f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/webp
x-styx-req-id: 26cda47e-5ddc-11ec-8fd2-baa71e14cff3
expires: Fri, 30 Dec 2022 14:34:51 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53c069ca0cdfe3-FRA
x-pantheon-styx-hostname: styx-fe2-b-79754f9dc6-9hr9h

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 86 KB
33 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86

Requested by

Host: t.co
URL: https://t.co/z9xWApU9G1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cf6c73fca701474be19ded2b84ec3419e9209d979d1e88233c69ed5e1d83c6e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33758
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 29 Dec 2021 14:34:51 GMT

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 193 KB
56 KB 37ms
8ms Script
application/javascript 2600:9000:2156:ce00:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Requested by: Host: t.co
URL: https://t.co/z9xWApU9G1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:ce00:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 19408a2a6d8207752bb520e95e694c4f2e4e56d93c4a3e0a4cc3753e8b5dd33d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 24 Dec 2021 03:34:24 GMT
content-encoding: gzip
age: 471628
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 20 Dec 2021 22:48:10 GMT
server: AmazonS3
etag: W/"58b53f4f1db062679d6a7cdc258d2cfe"
vary: Accept-Encoding
x-amz-version-id: JGCD0MqQAK2z07sl5epncp464KxxSm7K
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=691200
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: 2c9e8_KAQC1AAni3O_Q1sFgcYtdxFBx9OhekEsTNwM443nIwV4JkhA==

GET
H2 200 container_41sBJe2I.js Show response
cdn.matomo.cloud/recordedfuture.matomo.cloud/ 25 KB
8 KB 37ms
9ms Script
application/javascript 2600:9000:2156:ce00:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_41sBJe2I.js
Requested by: Host: t.co
URL: https://t.co/z9xWApU9G1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:ce00:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0d29a99ba6e6339a9e40f9cb8ec7f396c94beae09ce7cfc28ea886c24826ea22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 27 Dec 2021 19:31:51 GMT
content-encoding: gzip
age: 154981
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 20 Dec 2021 22:48:10 GMT
server: AmazonS3
etag: W/"eacbf10aba86e780c7be3d168e5ce52a"
vary: Accept-Encoding
x-amz-version-id: Ap.ZmkicvvkJ_miwo.asmF.Pci0o0KZP
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=691200
x-amz-cf-pop: FRA50-C1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: ACqJYO432ZSFAAoSLs4yITHesd-FBjMje6dVLmNWIqUJvzP4bXz9Ww==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-9153858-16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 5625
date: Wed, 29 Dec 2021 13:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 29 Dec 2021 15:01:06 GMT

GET
H3 200 jquery.mousewheel.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/ 3 KB
2 KB 32ms
15ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/bundle.js?ver=2021-06-29_1

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4116206
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1046
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-ad3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XsZeKIjQnY2W09BAt71EyxYUdoXCCGVexSAH2id%2BgNRzxE%2Baj9dQ6dDaJrEDsl0F8eeOuayxkZ35uF5H7ZbPHhTzOi%2Bq3SNtPHu4pZNcVtluw4YPUyRXKYXQN5yhmQnRAWPQyCSmEl38Shcqr2ML8cvZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6c53c06a69e94a9e-FRA
expires: Mon, 19 Dec 2022 14:34:51 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
1 KB 55ms
28ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/themes/therecordmedia/assets/js/main.js?ver=2021-06-29_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8002dace9aa6d2f5a60968e10897ec4b45e698b2851a22320a6cb5f7df42c67c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"
expires: Wed, 29 Dec 2021 14:34:51 GMT

GET
H2 200 252628.js Show response
js.hs-analytics.net/analytics/1640788200000/ 63 KB
20 KB 61ms
27ms Script
text/javascript 2606:4700::6811:46b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1640788200000/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f958b4527bcb3c4da9d038386657b0a8e498e40bb6d5eede4f0a42d4b1503221

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
cf-cache-status: HIT
age: 58
x-amz-server-side-encryption: AES256
x-amz-request-id: VYN3GKHBYF7RP7RN
x-amz-id-2: Le9d9VrT/NCJukUduM/YixU5L3GILnJMy9CxWnxSxMJLAID6OImRI31Ustt1zIv9aB3ilIW/Kx4=
last-modified: Mon, 19 Jul 2021 13:55:02 GMT
server: cloudflare
etag: W/"eb683456778d317c80ce91826fab13f7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-ray: 6c53c06a9fa9062d-FRA
expires: Wed, 29 Dec 2021 14:38:53 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 537 KB
87 KB 62ms
31ms Script
application/javascript 2606:4700::6811:e9cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e9cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb54934c45f4c74ce2c3d2cc7b8b08b49b5c75d1dc0a64dd5071bf2b452c69ea

Request headers

Referer: https://therecord.media/
Origin: https://therecord.media
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
via: 1.1 b9d1b307966c2273bf97ed7c681603db.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 1357
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1066/bundle/main/lead-flows-release.js&cfRay=6c539f487da3d6dd-IAD
x-cache: Hit from cloudfront
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 6c53c06a9b68695d-FRA
last-modified: Fri, 10 Dec 2021 01:08:50 UTC
server: cloudflare
etag: W/"a20da5f3327ff62c3dfbc71571e4fc6d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: L5EK4Wtvn0GVRD3yODp9CC_dzIEEuKk.
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: MISS
x-amz-cf-pop: IAD89-P1
content-type: application/javascript; charset=utf-8
x-amz-cf-id: h5ppW4kSCZRuND4vExtKBeXX0hYIud2KKY9khKuIo7j1954Bv9D1Qg==
x-hs-target-asset: lead-flows-js/static-1.1066/bundle/main/lead-flows-release.js

GET
H2 200 252628.js Show response
js.hs-banner.com/ 61 KB
16 KB 49ms
25ms Script
text/javascript 2606:4700::6812:14bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/252628.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/252628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:14bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e90135befb1cde3a65a625bd4b1947fe8241484d5248194fbb3ab8b3b9912706

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
cf-cache-status: HIT
age: 197
x-amz-server-side-encryption: AES256
content-type: text/javascript; charset=UTF-8
access-control-max-age: 604800
x-amz-request-id: GHJVCEW4ZCTWF1RE
x-amz-id-2: fMv47BT7iQAngUL0BYYSYyRMdiJOC3QWv9Znjkk19JeLfedfGj4czMB+aP+bjbgvBvfhWCput3k=
timing-allow-origin: *
last-modified: Fri, 03 Sep 2021 19:24:49 GMT
server: cloudflare
etag: W/"e0c913f4a0cc31dc55b4467584a6d8e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id: lq2tXQvbi9wr797yewJV6QQGCJrrtX2q
access-control-allow-origin: https://www.recordedfuture.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
cf-ray: 6c53c06a8ce6c2c2-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Wed, 29 Dec 2021 14:36:34 GMT

GET
H2 200 / Show response
therecord.media/wp-json/complianz/v1/banner/ 130 B
597 B 570ms
570ms XHR
application/json 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://therecord.media/wp-json/complianz/v1/banner/?lang=en&locale=en_US&token=qesms

Requested by

Host: therecord.media
URL: https://therecord.media/wp-content/plugins/complianz-gdpr-premium/assets/js/complianz.min.js?ver=5.2.5.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3026cea7eff6a33625644f88eef3c6418831341116ff8f04054da6c7abc138f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-type: application/json

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
age: 0
x-cache: MISS, MISS
x-cache-hits: 0, 0
content-encoding: br
vary: Accept-Encoding
x-served-by: cache-mdw17342-MDW, cache-iad-kjyo7100111-IAD
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
server: cloudflare
x-timer: S1640788492.292889,VS0,VE131
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
x-styx-req-id: 7bdcc4bf-68b4-11ec-9a7f-02d924bfecf7
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
cf-ray: 6c53c06a7aecdfe3-FRA
link: <https://therecord.media/wp-json/>; rel="https://api.w.org/"
x-pantheon-styx-hostname: styx-fe2-b-79754f9dc6-lhh9b

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 27 KB
9 KB 39ms
7ms Script
application/javascript 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: t.co
URL: https://t.co/z9xWApU9G1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8575
Pragma: no-cache
Last-Modified: Thu, 07 Oct 2021 17:17:43 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615f2bb7-6a5f"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 29 Dec 2021 14:34:51 GMT

GET
H2 200 252628.js Show response
js.hs-scripts.com/ 1 KB
496 B 17ms
17ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/252628.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVJ5W86
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cbc744238de02ebb66ea4c577a57445866f838e029a48ca7d4d82c1cc76efa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:51 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 59
cf-polished: origSize=1482
x-hubspot-correlation-id: 895af15e-ec20-474c-a05c-421c1f703649
last-modified: Wed, 29 Dec 2021 14:33:52 GMT
server: cloudflare
x-trace: 2B1A4BC4866D8D6D1DB21121E09347AF45A212B99B000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://therecord.media
expires: Wed, 29 Dec 2021 14:35:51 GMT
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 6c53c06a7f774ea4-FRA
cf-bgj: minify

GET
H2 200 5fcff613fdfb0dbe15ddb3c49d4f54cd
secure.gravatar.com/avatar/ 3 KB
3 KB 21ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fcff613fdfb0dbe15ddb3c49d4f54cd?s=96&d=mm&r=g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: b7385d6b65674888c6500c665b56a10ef98183a22dc8674ec0caf3deb532d215

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 29 Dec 2021 14:34:51 GMT
last-modified: Fri, 05 Mar 2021 15:49:20 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fcff613fdfb0dbe15ddb3c49d4f54cd.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fcff613fdfb0dbe15ddb3c49d4f54cd?s=96&d=mm&r=g>; rel="canonical"
content-length: 3276
expires: Wed, 29 Dec 2021 14:39:51 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 28ms
14ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1611641580&t=pageview&_s=1&dl=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1830303701&gjid=1156558739&cid=2107492115.1640788492&tid=UA-9153858-16&_gid=1807407673.1640788492&_r=1&gtm=2ouc10&z=771108900

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://therecord.media/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 29 Dec 2021 14:34:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://therecord.media
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 matomo.php
recordedfuture.matomo.cloud/ 0
168 B 87ms
61ms Ping
text/plain 35.71.162.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recordedfuture.matomo.cloud/matomo.php?action_name=therecord.media%2FIranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future&idsite=2&rec=1&r=998150&h=14&m=34&s=51&url=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&urlref=https%3A%2F%2Ft.co%2F&_id=e83919c9070ba799&_idn=1&_refts=1640788492&_ref=https%3A%2F%2Ft.co%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=604LCM&fa_pv=1&fa_fp[0][fa_vid]=Ry4Pwr&fa_fp[0][fa_fv]=1&fa_fp[2][fa_vid]=VL80oJ&fa_fp[2][fa_fv]=1&fa_fp[3][fa_vid]=OurBCe&fa_fp[3][fa_fv]=1&pf_net=38&pf_srv=539&pf_tfr=2&pf_dm1=20&pf_dm2=151&pf_onl=1
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.162.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a8b6f710f441cdbc2.awsglobalaccelerator.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://therecord.media/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://therecord.media
date: Wed, 29 Dec 2021 14:34:52 GMT
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent

GET
H3 200 jquery.mCustomScrollbar.min.css Show response
cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/ 42 KB
4 KB 50ms
34ms XHR
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/malihu-custom-scrollbar-plugin/3.1.5/jquery.mCustomScrollbar.min.css?ver=2021-06-29_1

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

247184981eb6f698a94e431a83d68c6b0df623cce57b6e29dc5a6c11e23aa195

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1177611
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3359
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:12:04 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed4-a757"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7opNFl4ojXt3n0hcxR76XMi5n8c61PCl75XYjpF%2BV3qFZY3OTfJ8bW00g4cbekAUp6MzcB8MePf3PYNN%2BbDixO8fIb%2BR%2BIYWJNjxU1a29st6EgL9QwgCmtw%2BYcadVMq1QA7TY6rV85%2Fw1a6bjXT1ShO4"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6c53c06b192343b8-FRA
expires: Mon, 19 Dec 2022 14:34:52 GMT

GET
H3 200 jquery.fancybox.min.css Show response
cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/ 12 KB
4 KB 35ms
21ms XHR
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/fancyapps/fancybox@3.5.7/dist/jquery.fancybox.min.css?ver=2021-06-29_1

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5593679
x-jsd-version: 3.5.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19144-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"31fb-G+m3m+AqHPxdlsSl4P649HK6vZU"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6c53c06b18304de2-FRA

GET
H2 200 configs.php Show response
recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
290 B 14ms
13ms Script
application/javascript 35.71.162.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=2&trackerid=rYYxXU&url=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.162.228 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a8b6f710f441cdbc2.awsglobalaccelerator.com
Software: Apache /
Resource Hash: 8597409bbd3b8440cb1ddd4793f069e4384a6155184596e4f75d3a149465194d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
content-encoding: gzip
server: Apache
content-length: 119
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent
content-type: application/javascript

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/8da38e9a/www-widgetapi.vflset/ 149 KB
48 KB 24ms
9ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/8da38e9a/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5071f1b82cf34198f13d9c727f4705d7a4daa61723adacfcd7123abcb4b3c4c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 08:08:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23163
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49407
x-xss-protection: 0
last-modified: Fri, 17 Dec 2021 22:18:14 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 29 Dec 2022 08:08:49 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
689 B 82ms
46ms XHR
application/json 185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Dec 2021 14:34:52 GMT
X-Proxy-Origin: 91.238.82.158; 91.238.82.158; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 87970c7f-4b36-47c5-905c-20a48a3cac57
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://therecord.media
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
371 B 30ms
6ms XHR
text/plain 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-233-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5363aedd82a4c0e615815ffb9ab4b2c03563c38fa0cea86532069bb07b759d48

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:52 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://therecord.media
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1003 B 161ms
121ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1433769858&v=1.1&a=252628&rcu=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&r=https%3A%2F%2Ft.co%2F&pu=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&t=Iranian+hackers+behind+Cox+Media+Group+ransomware+attack+-+The+Record+by+Recorded+Future&cts=1640788492052&vi=58948540c2d4b83ea6e13abd96860dce&nc=true&u=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&b=156209188.1.1640788492047&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: e0418703-31cc-4b1e-a280-45873c7e2875
cf-ray: 6c53c06bab406922-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FGh61aO38F3U6iqLzyTp1sWvNpFGubEDNb6M%2BomiOmmwVkDEdikkbwhcQlnIJTiks2UWpKUPI7DF36%2FkW4vCrG4fjC2hSRjaSyW%2Bk%2FG9O%2BpwYrXsYi5yCg0zt1NV3FkiFI8Nv5F%2FQxmEyVUGBXuc"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 210ms
179ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A52%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:52 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 165ms
139ms XHR
application/json 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=58948540c2d4b83ea6e13abd96860dce&__hstc=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&__hssc=156209188.1.1640788492047&referrer=https%3A%2F%2Ft.co%2F&currentUrl=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19a01f4193988048be83c6c0cb8caaaa882ea9736bcaa7ba20f67172b7ac3c69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 9e6baf02-bf9c-4812-8039-4e20d2e440a4
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-robots-tag: none
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U4qhE3bpFK%2BBhv3T3nvw3bCMNNHCsWTqFbUfDsxW%2B5XlpIoZm9PzDOs8%2B5R%2BLRniZ9aSTtGaKzVJi8rfnk6CcNOUmnK3OVgevgqV3W4zVHByPsm6s0Qo2t7gqM%2FCNPQ1oesyjg37Jsl5BmtnQOJT"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://therecord.media
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 6c53c06c4a6705ed-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent

GET
H3 200 __ptq.gif
track.hubspot.com/ 45 B
784 B 162ms
151ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=1b047a85-2db0-47ce-a965-8fa2de5a991b&lfi=2694169&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1433769858&v=1.1&a=252628&rcu=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&r=https%3A%2F%2Ft.co%2F&pu=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&t=Iranian+hackers+behind+Cox+Media+Group+ransomware+attack+-+The+Record+by+Recorded+Future&cts=1640788492343&vi=58948540c2d4b83ea6e13abd96860dce&nc=true&u=156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1&b=156209188.1.1640788492047&cc=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:52 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 4d36de32-91e0-4df3-a61b-17a0d65864b1
cf-ray: 6c53c06d3a2f4a74-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wii496nhE6ZX4%2BZGv05F424SMtfT6j%2Bkp%2BoqZ%2Fqe%2FXy2MFSS3ImvozxJ4AGw%2B2QlcdxTZasvTDmrBp3QkVNyTNy08dEVTtdOVNOzrrw%2FZIkoECTeJha%2Br9lZlVTKBSZzyKJz8CPod0c0DHz4mzXM"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 187ms
186ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:53 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 iphonex_mockup.png
go.recordedfuture.com/hubfs/ 190 KB
192 KB 127ms
44ms Image
image/webp 2606:2c40::c73c:67fe
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.recordedfuture.com/hubfs/iphonex_mockup.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67fe , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f5a9ec8652b839da4c94dadcf813b464f836d80d6083989853f1033957acc60

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-meta-cache-tag: F-38679274737,P-252628,FLS-ALL
age: 1181205
x-amz-server-side-encryption: AES256
edge-cache-tag: F-38679274737,P-252628,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="iphonex_mockup.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 12
x-amz-request-id: 66FXV48WRK254DQX
cf-bgj: imgq:85,h2pri
etag: "8e4a9a910444dc630d9dde1cc3bd77f7"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis: 1607733110293
date: Wed, 29 Dec 2021 14:34:53 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA2-C1
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=331559
x-cache: RefreshHit from cloudfront
x-amz-meta-index-tag: all
content-length: 194832
x-amz-id-2: 6dOSuj6tNkGOHW281v2fEJpS2fDuGIYP4Tjsnf+3HB9RIpXPoUYppn6kuIL+y4VzrDnLM/2UmIY=
last-modified: Thu, 09 Dec 2021 17:00:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Of3ChTUT3nDVWMXikGnVvcTS51zHsoK8FpClUh4kkb5QRmPk8iSRoH5TMUHEHwxPvS2Yq5aZ3MajVcYnccwJ3pHtDoreyZUmdVvbwofL0%2FmqHpj1n8wZerlDdX5AnqmidiG68m6qD7kuIgCMvZzrO6PdTw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: r9ZOT95rdFsvuhynefdRWZgkO0lzhV1L
accept-ranges: bytes
cf-ray: 6c53c073fce31766-FRA
x-amz-cf-id: Fijh6tq5fBF6C-NiOYgzsmL_mCrbaC_4pl-6coigSERkQmXEBPFgYA==

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 177ms
177ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:54 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 179ms
179ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:55 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 176ms
176ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:56 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 184ms
184ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A56%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:57 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 177ms
177ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A58%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A57%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226008%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:58 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 177ms
177ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A58%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227009%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://therecord.media/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 29 Dec 2021 14:34:59 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=36bb1002e41400000b72cc61b5030000e5270400&session=95bdb1a2-47a4-426b-89e2-1f7d1f89117b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A35%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2029%20Dec%202021%2014%3A34%3A59%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228010%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Record%20by%20Recorded%20Future%20gives%20exclusive%2C%20behind-the-scenes%20access%20to%20leaders%2C%20policymakers%2C%20researchers%2C%20and%20the%20shadows%20of%20the%20cyber%20underground.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20The%20Record%20by%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Ftherecord.media%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F&pageViewId=5d88c25d-1e20-4301-8c31-3287535de9bb&an_uid=0

Verdicts & Comments Add Verdict or Comment

94 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-20 17:17:40	Name: muc Value: fbdb59c1-5788-4b83-871e-5a5cefbc1f08
.t.co/	1970-01-20 17:17:40	Name: muc_ads Value: fbdb59c1-5788-4b83-871e-5a5cefbc1f08
therecord.media/	1969-12-31 23:59:59	Name: wordpress_google_apps_login Value: 5d330a2a77a9011b12d2adcc86515520
.therecord.media/	1970-01-20 17:17:40	Name: _ga Value: GA1.2.2107492115.1640788492
.therecord.media/	1970-01-19 23:47:54	Name: _gid Value: GA1.2.1807407673.1640788492
.therecord.media/	1970-01-19 23:46:28	Name: _gat_gtag_UA_9153858_16 Value: 1
.therecord.media/	1970-01-20 04:09:16	Name: _pk_ref.2.de70 Value: %5B%22%22%2C%22%22%2C1640788492%2C%22https%3A%2F%2Ft.co%2F%22%5D
.therecord.media/	1970-01-20 09:12:23	Name: _pk_id.2.de70 Value: e83919c9070ba799.1640788492.
.therecord.media/	1970-01-19 23:46:30	Name: _pk_ses.2.de70 Value: 1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: q5No1NRVhEk
.youtube.com/	1970-01-20 04:05:40	Name: VISITOR_INFO1_LIVE Value: 6_rA746iplU
.6sc.co/	1970-01-20 17:17:40	Name: 6suuid Value: 36bb1002e41400000b72cc61b5030000e5270400
.therecord.media/	1970-01-20 09:08:04	Name: __hstc Value: 156209188.58948540c2d4b83ea6e13abd96860dce.1640788492047.1640788492047.1640788492047.1
.therecord.media/	1970-01-20 09:08:04	Name: hubspotutk Value: 58948540c2d4b83ea6e13abd96860dce
.therecord.media/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.therecord.media/	1970-01-19 23:46:30	Name: __hssc Value: 156209188.1.1640788492047
therecord.media/	1970-01-20 17:17:40	Name: _gd_svisitor Value: 36bb1002e41400000b72cc61b5030000e5270400
therecord.media/	1970-01-19 23:56:33	Name: _an_uid Value: 0
therecord.media/	1970-01-20 17:17:40	Name: _gd_visitor Value: d6ecea80-f4d9-42be-8d94-0ed9b974c8f9
therecord.media/	1970-01-19 23:46:42	Name: _gd_session Value: 95bdb1a2-47a4-426b-89e2-1f7d1f89117b
.hubspot.com/	1970-01-19 23:46:30	Name: __cf_bm Value: 23lItAD0D1hXzVmQfX06gJCoN0se9PmysMJzStmFiKI-1640788492-0-AcgAKi2zTwFBUOT+KOqR7xiNBq7QosayImKeRByxeX023XtPKtAF/ZYj0YM70x+7iT/2HeQfIlajB4E1O3X1gXw=
therecord.media/	1970-01-20 08:32:04	Name: cmplz_policy_id Value: 19
therecord.media/	1970-01-20 08:32:04	Name: cmplz_functional Value: allow
therecord.media/	1970-01-20 08:32:04	Name: cmplz_statistics-anonymous Value: allow
.go.recordedfuture.com/	1969-12-31 23:59:59	Name: __cfruid Value: 93b0fe9f0da25008111a4b5f0244921add2f849f-1640788493

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.6sc.co
c.6sc.co
cdn.jsdelivr.net
cdn.matomo.cloud
cdnjs.cloudflare.com
forms.hubspot.com
go.recordedfuture.com
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
recordedfuture.matomo.cloud
secure.adnxs.com
secure.gravatar.com
t.co
therecord.media
track.hubspot.com
www.google-analytics.com
www.googletagmanager.com
www.recordedfuture.com
www.youtube.com
b.6sc.co
104.111.233.140
104.18.12.124
104.244.42.5
185.33.220.240
2600:9000:2156:ce00:c:7d55:b3c0:93a1
2606:2c40::c73c:67fe
2606:4700::6810:125e
2606:4700::6810:5614
2606:4700::6811:46b0
2606:4700::6811:d4cc
2606:4700::6811:e9cc
2606:4700::6812:14bf
2606:4700::6812:621
2606:4700::6813:9a53
2606:4700::6813:9b53
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2008
2a00:1450:4001:82b::200e
2a04:fa87:fffe::c000:4902
35.71.162.228
00a1230e22b6af3f9df1348f2cd54dc9dbe026f3a41b9bde3009dcefd1648ae1
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0d29a99ba6e6339a9e40f9cb8ec7f396c94beae09ce7cfc28ea886c24826ea22
13a5d6deee5c86d1c86f8ab010b3dfcab1b0b500590024d8c7a44c279c96d443
19408a2a6d8207752bb520e95e694c4f2e4e56d93c4a3e0a4cc3753e8b5dd33d
19a01f4193988048be83c6c0cb8caaaa882ea9736bcaa7ba20f67172b7ac3c69
247184981eb6f698a94e431a83d68c6b0df623cce57b6e29dc5a6c11e23aa195
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
2ad4e6985a44bf39fed115e7bfe09d64793fc636cb2588fe9afe8ee9b904c644
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
326d6c39524da9a4b3d35286c798b93738a4665b29ce498d5b5df959a3a19012
47735e0d72abf01b03a763a19c6d46804ee6c2f461b7ecb72129c664a8c98d0f
4a6db13132ef5e4dc98723529dedf677f84b4993b7db70339cb1de93a910ffce
5071f1b82cf34198f13d9c727f4705d7a4daa61723adacfcd7123abcb4b3c4c7
5363aedd82a4c0e615815ffb9ab4b2c03563c38fa0cea86532069bb07b759d48
549e5366744b2259bab7b9d27e121ec7deefd7f527ae7293f22e518f0495e296
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
57ed6e420d993538f3888941403c63f4358b7fc8d9215eae2cd90bc4e12291a6
6429c09d26d4abed1c51691f17eb89c9c1fedf440964890e2a0fe9801e93e653
6a8cba1e5861ac81c699cbf3afce53b3229b282c9b81f4e4695b6a83500bf7d7
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
77e8232dee29ca904e5726f29b02f784c6155de5e388e61570a74aedf61b69de
8002dace9aa6d2f5a60968e10897ec4b45e698b2851a22320a6cb5f7df42c67c
81dbdd695385ce9e3065e0cf1d8f058169de79244b1d1be4059b527e31d23c77
82bfc506040c981ec142b63ec85a43e603310d9b5fac6598c5664a144f3c4e3e
8597409bbd3b8440cb1ddd4793f069e4384a6155184596e4f75d3a149465194d
8b6d59899727d24e2745e5f285811ab052169fce05487c35ab8b8ba11487b63c
8df981a2e0d74a44530cfe140f2ce72ad4cb7be724706b7a3cfcb160bd06590f
8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9f5a9ec8652b839da4c94dadcf813b464f836d80d6083989853f1033957acc60
9f7b3c1c9a817380967e2d68f41c86b4649b68dba06b37a49dab55bb5c5a6eab
a01127152b090004aa159e0d56664e2268a1de5334ba6d9d6515388a0f53a3b9
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a3026cea7eff6a33625644f88eef3c6418831341116ff8f04054da6c7abc138f
b31a805b14cdf1311a94debe97e7d5695f38eca4dddc65d98cb58e9c281cf36d
b7385d6b65674888c6500c665b56a10ef98183a22dc8674ec0caf3deb532d215
bb54934c45f4c74ce2c3d2cc7b8b08b49b5c75d1dc0a64dd5071bf2b452c69ea
bcf55f419720f33d9092e5769b9a1c1cefd7269e2c19cebb754d4d9257894ea7
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c21f3f80c9adfdf9070c994d881f2069818a2d409b62834c805a7f17f08c91ef
c4e20f53f5ef0ed44b783437aa3f4638a9a56cc4aa29ae83ed9212eb2807052a
cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ce42194a19b1b5cf0191b339629deba1e3441298dc72a3145fe37f65276f09a2
cf6c73fca701474be19ded2b84ec3419e9209d979d1e88233c69ed5e1d83c6e6
d8be3a402a3b2ad808402cea111ba3d286239d88e06c8e2969c84f46050dc88a
d9697e2769a5484e3d9086c6f3c97746dff2d88d5c0bd7c5367a020dd5d097ce
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d3367b895674ec706b02be65ae0ee7416f158836f88ddc1d3e469e3bdd6cd4
e90135befb1cde3a65a625bd4b1947fe8241484d5248194fbb3ab8b3b9912706
f1010cf08825a41c768a117755a496da61a306c41b83c383ea66f1bb3334bb14
f23ec5c633f64e45cdb8119ea2bd55f81bd2bf4a46131cc6e7aa415024db18f1
f6cbc744238de02ebb66ea4c577a57445866f838e029a48ca7d4d82c1cc76efa
f958b4527bcb3c4da9d038386657b0a8e498e40bb6d5eede4f0a42d4b1503221

therecord.media Open in urlscan Pro 2606:4700::6812:621 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

71 Requests

99 %HTTPS

75 %IPv6

17 Domains

22 Subdomains

21 IPs

5 Countries

1343 kBTransfer

3251 kBSize

25 Cookies

15 Outgoing links

Page URL History

Redirected requests

71 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

therecord.media Open in urlscan Pro
2606:4700::6812:621 Public Scan

Screenshot
Live screenshot

Full Image

71
Requests

99 %
HTTPS

75 %
IPv6

17
Domains

22
Subdomains

21
IPs

5
Countries

1343 kB
Transfer

3251 kB
Size

25
Cookies

71 HTTP transactions
0 data transactions