threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i
Effective URL:
https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMy...
Submission: On October 06 via api (October 6th 2020, 3:48:58 pm UTC) from US

Summary HTTP 236 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 59 IPs in 9 countries across 46 domains to perform 236 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	52.84.112.89 52.84.112.89	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:e0:... 2606:4700:e0::ac40:6926	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 13	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:215... 2600:9000:2156:600:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2600:9000:206... 2600:9000:206e:3000:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
3 12	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
7	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE)
3	52.84.113.143 52.84.113.143	16509 (AMAZON-02) (AMAZON-02)
1 15	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:816::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::2003	15169 (GOOGLE) (GOOGLE)
9	18.218.150.139 18.218.150.139	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	2600:9000:203... 2600:9000:203c:be00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.212.5.193 52.212.5.193	16509 (AMAZON-02) (AMAZON-02)
2 3	216.52.2.19 216.52.2.19	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
3	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	165.227.252.242 165.227.252.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
2 6	37.252.173.22 37.252.173.22	29990 (ASN-APPNEX) (ASN-APPNEX)
1 7	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
4	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
10 15	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
5	100.24.218.250 100.24.218.250	14618 (AMAZON-AES) (AMAZON-AES)
1	35.159.48.82 35.159.48.82	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2001	15169 (GOOGLE) (GOOGLE)
26	2a00:1450:400... 2a00:1450:4001:824::2001	15169 (GOOGLE) (GOOGLE)
1	64.140.160.2 64.140.160.2	18450 (WEBNX) (WEBNX)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
1	18.197.185.70 18.197.185.70	16509 (AMAZON-02) (AMAZON-02)
2 6	23.210.249.164 23.210.249.164	16625 (AKAMAI-AS) (AKAMAI-AS)
15	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1 1	167.172.1.14 167.172.1.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	35.158.206.167 35.158.206.167	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	23.210.249.92 23.210.249.92	16625 (AKAMAI-AS) (AKAMAI-AS)
3	151.101.113.108 151.101.113.108	54113 (FASTLY) (FASTLY)
2 2	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 3	52.17.171.52 52.17.171.52	16509 (AMAZON-02) (AMAZON-02)
3 7	52.28.239.147 52.28.239.147	16509 (AMAZON-02) (AMAZON-02)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-) (VCLK-EU-)
1	37.157.6.242 37.157.6.242	198622 (ADFORM) (ADFORM)
1 1	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY)
236	59

1 104.17.74.206 (United States)

ASN13335 (CLOUDFLARENET, US)

content.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.84.112.89 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-112-89.sof50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:e0::ac40:6926 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2156:600:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:206e:3000:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland) 1 redirects

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.23.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f130.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.84.113.143 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-113-143.sof50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 151.101.194.137 (United States) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.218.150.139 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-218-150-139.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:f916:5049:f87f:108e (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:203c:be00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.5.193 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-5-193.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.52.2.19 (United States) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.135 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.252.173.22 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.244.159.8 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 10 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 100.24.218.250 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-24-218-250.compute-1.amazonaws.com

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.159.48.82 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-159-48-82.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

1e153fedc91d27392c0434ac3ad9ded0.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:824::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.140.160.2 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com

geo.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.197.185.70 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.210.249.164 (Netherlands) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-164.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.1.14 (United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.206.167 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-206-167.eu-central-1.compute.amazonaws.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.249.92 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-92.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.113.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.80 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.17.171.52 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-171-52.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.28.239.147 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.242 (Denmark)

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.2 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s20-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	894 KB
31	googlesyndication.com 1e153fedc91d27392c0434ac3ad9ded0.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	412 KB
24	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	1 MB
23	advertising.com 13 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	12 KB
15	ampproject.org cdn.ampproject.org	322 KB
14	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	127 KB
13	google.com 3 redirects www.google.com adservice.google.com	3 KB
11	adlightning.com tagan.adlightning.com	222 KB
9	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	5 KB
8	pubmatic.com 2 redirects hbopenbid.pubmatic.com ads.pubmatic.com image2.pubmatic.com	2 KB
7	openx.net 1 redirects teachingaids-d.openx.net eu-u.openx.net u.openx.net	1 KB
7	admetricspro.com qd.admetricspro.com	283 KB
5	a-mo.net prebid.a-mo.net	2 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	8 KB
4	casalemedia.com 2 redirects htlb.casalemedia.com as-sec.casalemedia.com Failed ssum.casalemedia.com	2 KB
3	yahoo.com pr-bh.ybp.yahoo.com ups.analytics.yahoo.com	2 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	indexww.com js-sec.indexww.com
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	622 B
3	lijit.com 2 redirects ap.lijit.com	2 KB
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	10 KB
3	google-analytics.com www.google-analytics.com	19 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	156 KB
3	amazon-adsystem.com c.amazon-adsystem.com	32 KB
3	googletagservices.com www.googletagservices.com	73 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	645 B
2	googleapis.com fonts.googleapis.com	2 KB
2	google.de www.google.de adservice.google.de	1 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
2	servenobid.com ads.servenobid.com public.servenobid.com	3 KB
1	adform.net c1.adform.net	188 B
1	dotomi.com aol-match.dotomi.com	104 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	582 B
1	twitter.com analytics.twitter.com	655 B
1	ipify.org geo.ipify.org	1 KB
1	t.co t.co	449 B
1	quantcount.com rules.quantcount.com	355 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	48 KB
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
1	wp.com i0.wp.com	65 B
1	gravatar.com 1 redirects secure.gravatar.com	372 B
1	cloudflare.com content.cloudflare.com	1 KB
236	46

	Domain	Requested by
26	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
17	threatpost.com	content.cloudflare.com threatpost.com
15	cdn.ampproject.org	threatpost.com
15	adserver-us.adtech.advertising.com	10 redirects threatpost.com
12	www.google.com	3 redirects threatpost.com tagan.adlightning.com
11	media.threatpost.com	threatpost.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
9	vid.connatix.com	cd.connatix.com
9	capi.connatix.com	cd.connatix.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
7	pixel.advertising.com	3 redirects
7	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
7	qd.admetricspro.com	threatpost.com qd.admetricspro.com
6	ib.adnxs.com	2 redirects qd.admetricspro.com cds.connatix.com
5	prebid.a-mo.net	qd.admetricspro.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
4	fastlane.rubiconproject.com	qd.admetricspro.com
3	cm.g.doubleclick.net	3 redirects
3	match.adsrvr.org	2 redirects
3	js-sec.indexww.com	qd.admetricspro.com cds.connatix.com
3	acdn.adnxs.com	qd.admetricspro.com cds.connatix.com
3	ads.pubmatic.com	qd.admetricspro.com cds.connatix.com
3	googleads.g.doubleclick.net
3	teachingaids-d.openx.net	qd.admetricspro.com cds.connatix.com
3	hbopenbid.pubmatic.com	qd.admetricspro.com cds.connatix.com
3	ap.lijit.com	2 redirects qd.admetricspro.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	cds.connatix.com	threatpost.com tagan.adlightning.com cd.connatix.com
3	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com
3	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
2	sync-tm.everesttech.net	2 redirects
2	ups.analytics.yahoo.com
2	u.openx.net	cds.connatix.com
2	ssum.casalemedia.com	2 redirects
2	image2.pubmatic.com	2 redirects
2	eu-u.openx.net	1 redirects qd.admetricspro.com
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	threatpost.com
2	img.connatix.com	threatpost.com
2	pixel.quantserve.com	1 redirects threatpost.com
1	pr-bh.ybp.yahoo.com
1	c1.adform.net
1	aol-match.dotomi.com
1	public.servenobid.com	qd.admetricspro.com
1	eus.rubiconproject.com	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	ads.adaptv.advertising.com	cds.connatix.com
1	as-sec.casalemedia.com	cds.connatix.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	analytics.twitter.com	tagan.adlightning.com
1	geo.ipify.org	qd.admetricspro.com
1	1e153fedc91d27392c0434ac3ad9ded0.safeframe.googlesyndication.com	tagan.adlightning.com
1	adservice.google.com	tagan.adlightning.com
1	adservice.google.de	tagan.adlightning.com
1	www.google.de	threatpost.com
1	t.co	threatpost.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	tlx.3lift.com	qd.admetricspro.com
1	htlb.casalemedia.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	rules.quantcount.com	secure.quantserve.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.gstatic.com	www.google.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	cd.connatix.com	1 redirects
1	i0.wp.com	threatpost.com
1	secure.gravatar.com	1 redirects
1	content.cloudflare.com
236	75

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
www.ucsf.edu
healthitsecurity.com
attendee.gotowebinar.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
content.cloudflare.com Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.a-mo.net Amazon	`2020-08-24` - `2021-09-24`	a year	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-10-02` - `2021-04-02`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-06` - `2021-04-14`	6 months	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-10-04` - `2021-03-31`	6 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh

This page contains 27 frames:

Primary Page: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Frame ID: 683D493AD1363D8A6AD617C6E1F80E3E
Requests: 115 HTTP requests in this frame

Frame: https://cds.connatix.com/p/64351/connatix.player.dc.js
Frame ID: D8FDE7997EF25FCF8675F2BBA70B1AA5
Requests: 30 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=standard&size=normal&cb=nvz9kj3j62mm
Frame ID: E2D8EB97DD055F5C8068FB8A5ED285DF
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=light&size=normal&cb=1jtv1lrk8lnn
Frame ID: E38EDB557F8FA8A23473CD375EB47C44
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=iw1119hyn79g
Frame ID: 1C11D28DD707073B4711A1DECB55A09A
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Frame ID: 03DD6EF91E1327EAF76533925FAD73FA
Requests: 17 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=ucg56asa7816
Frame ID: DBA7C7B8B760F59FDB4E4988B18549FE
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Frame ID: 8E94A57E072C1DCAB92015583BF20CAD
Requests: 23 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Frame ID: FD04C453D57FEE4F831FC89EB1053A51
Requests: 17 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Frame ID: 440AF0BA6E38C73938BFB8C5AD420A9E
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/217/runner.html
Frame ID: 0639918C21637E3B6ACD992BF7C8DEA8
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 0DC75489CA5A93ADA0FA59568F1B4776
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: E122514507855E1EB8126CB3B2CFF056
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: B0EA8D0E3E51B755D9E1EAC25FBC8C7B
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: C6D411146F4C660056347950A6D2867B
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 076A14FF8CB5C8D6BA9C86EF6CE0A255
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 276DE8454AECD7893BEFACF0167C3AFD
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 2F3E219021996DCBA08DBD52C0F440E6
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 9BEFAEF51047FE80C8F0DC364BBD9E0C
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 5486772A57339F7618803D607D89B46C
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5F98CAC075D0E7C1599294922A59F16F
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 6D5493EDFE8634B708751320999D07C1
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: C9C50DD3CDE675CDA6BF3232E112B4B4
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: F231939909BAA6CD6EB53ED98D458523
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: E1BA254E9270D57A3C2548DAC328DB71
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 6284B2F352B0A6EC251273AB2E0DCF80
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: F7FB34BDAA8E296E5E99599BE9EC37CD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i Page URL
https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWm... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

236
Requests

98 %
HTTPS

40 %
IPv6

46
Domains

75
Subdomains

59
IPs

9
Countries

3805 kB
Transfer

8263 kB
Size

2
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf
Title: a recent security update

Search URL Search Domain Scan URL

URL: https://healthitsecurity.com/news/illinois-public-health-website-hit-with-ransomware-amid-coronavirus
Title: was reportedly behind

Search URL Search Domain Scan URL

URL: https://attendee.gotowebinar.com/register/441045308082589963?source=art
Title: FREE webinar

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23malware
Title: #malware

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23Windows
Title: #Windows

Search URL Search Domain Scan URL

URL: https://t.co/Lp2vkEecnp
Title: https://t.co/Lp2vkEecnp

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i Page URL
https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

https://secure.gravatar.com/avatar/8a7bc14570dc313d735b10c591e90fba?s=60&d=https%3A%2F%2Fthreatpost.com%2Fwp-content%2Fthemes%2Fthreatpost-2018%2Fassets%2Fimages%2Favatar-default.jpg&r=g HTTP 302
https://i0.wp.com/threatpost.com/wp-content/themes/threatpost-2018/assets/images/avatar-default.jpg?ssl=1

Request Chain 37

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/64351/connatix.player.dc.js

Request Chain 74

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A6962b8f0-07eb-11eb-9ff2-12a8bb4804a8;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985

Request Chain 75

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A6962324a-07eb-11eb-a1d0-1273d078354a;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985

Request Chain 76

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A696053b2-07eb-11eb-8286-126145921f52;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985

Request Chain 77

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A69621c1a-07eb-11eb-9883-12724de64e5e;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985

Request Chain 78

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A6962bfd0-07eb-11eb-9e07-128b912572ea;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985

Request Chain 180

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 181

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 183

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 203

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 205

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 206

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0 HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0

Request Chain 211

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID HTTP 302
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID HTTP 302
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=pubmatic&uid=34CDD6CF-8C4A-47C6-9F6E-F953F2B9086F

Request Chain 213

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true HTTP 307
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=sovrn&uid=b9972371ec247b87d9729be6

Request Chain 214

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=TY2rG0Ha-B1V0_1LS42xShrS-RpV2f8ZHdo3A0pm

Request Chain 217

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE2OTYyYjhmMC0wN2ViLTExZWItOWZmMi0xMmE4YmI0ODA0YTg%3D&gdpr=1&gdpr_consent=&_origin=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm=&google_hm=MUE2OTYyYjhmMC0wN2ViLTExZWItOWZmMi0xMmE4YmI0ODA0YTg%3D&gdpr=1&gdpr_consent=&_origin=0&google_tc= HTTP 302
https://pixel.advertising.com/ups/55946/sync?uid=CAESEGMZlYU0ydqAKc3HSXZ_4d4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Request Chain 218

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253Debed86fe-1756-4407-90fa-dd9ae626a43b%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=appnexus&uid=5320560874087046352

Request Chain 220

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1 HTTP 302
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=index_rtb&uid=X3yR4LlQJLcAAGYPPcEAAABH%26209

Request Chain 230

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1

Request Chain 231

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1 HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184

Request Chain 232

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X3yR3wAAAJwWnDrr&_origin=0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr HTTP 302
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X3yR3wAAAJwWnDrr&_origin=0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184

236 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 qKCX0Z77OR0Ii002S0Xo00i
content.cloudflare.com/ 605 B
1 KB 187ms
145ms Document
text/html 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: content.cloudflare.com
:scheme: https
:path: /qKCX0Z77OR0Ii002S0Xo00i
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 06 Oct 2020 15:48:40 GMT
content-type: text/html
set-cookie: __cfduid=d2e4293b2b4719a7dd9c1ecd4fc3cc5fc1601999320; expires=Thu, 05-Nov-20 15:48:40 GMT; path=/; domain=.content.cloudflare.com; HttpOnly; SameSite=Lax BIGipServerab_mailtracking_80=!SMCY06Ir9k0liglybf/nLIVwOTHiDmJGXW/tcIa13BVw1J4RQPlIQjXBBT14+Ule7g2fwklUJuq4AA==; path=/; Httponly; Secure __cf_bm=347b06cf1a13bceb03e2a40677903dcf13b6a939-1601999320-1800-ARPYnn1373Alj5uJu6Iqk5WzGWRDMSfOlobqldsrF11OziHedZjNqIJa1+WZz6J0edw2z9r/pX3zpTxjrZOdb4g=; path=/; expires=Tue, 06-Oct-20 16:18:40 GMT; domain=.content.cloudflare.com; HttpOnly; Secure; SameSite=None
cache-control: private, no-cache, no-store, max-age=0
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 05a032ceb10000735fc5bcd200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5de0872ab80b735f-CPH
content-encoding: gzip

GET
H/1.1 200
OK Primary Request / Show response
threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/ 83 KB
22 KB 694ms
357ms Document
text/html 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Requested by

Host: content.cloudflare.com
URL: https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d199e44b7ac1627b528510813cbfd7666c63a74f4651ee3e0e625960812e1baf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://content.cloudflare.com/qKCX0Z77OR0Ii002S0Xo00i

Response headers

Server: nginx
Date: Tue, 06 Oct 2020 15:48:41 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=157015>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 336ms
113ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:41 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
14 KB 217ms
76ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fe5bdb0c294ee9456263dfaa69649f568247737ca178293545a72a75cb586f8b

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: cKIg4BR110e6QBMvrQSBhcTlYb_H8STs
content-encoding: gzip
etag: "80c22ad7e4a450aab7e22c6fdd378e14"
age: 1729
x-cache: Hit from cloudfront
status: 200
content-length: 13378
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 06 Oct 2020 02:11:55 GMT
server: AmazonS3
date: Tue, 06 Oct 2020 15:31:06 GMT
content-type: application/javascript
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
x-amz-cf-id: BCykeBYvpyIhYzMb9483x233c4XTU2Rpp8S7dvTXu4JbP_bLJIqXdQ==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 211ms
165ms Script
application/javascript 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a032d24800002bc647291200000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999322"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de08730791e2bc6-FRA
expires: Tue, 06 Oct 2020 15:51:44 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 51 KB
18 KB 75ms
39ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e63418cf65f537931557747222a416409d17a0df2baaa6bf87891da0514cff20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "654 / 215 of 1000 / last-modified: 1601983104"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 17468
x-xss-protection: 0
expires: Tue, 06 Oct 2020 15:48:41 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 613ms
567ms Script
application/javascript 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a032d24800002bc647292200000001
last-modified: Tue, 25 Aug 2020 22:57:08 GMT
server: cloudflare
etag: W/"4c455-5adbb9f62c25a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999322"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de0873079252bc6-FRA
expires: Tue, 06 Oct 2020 15:56:01 GMT

GET
H2 200 uspcmp.js Show response
qd.admetricspro.com/js/threatpost/ 148 KB
55 KB 607ms
561ms Script
application/javascript 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a032d24800002bc647293200000001
last-modified: Sat, 08 Aug 2020 22:40:07 GMT
server: cloudflare
etag: W/"24e50-5ac65673cef1c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999322"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de0873079272bc6-FRA
expires: Tue, 06 Oct 2020 15:56:02 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
470 B 618ms
572ms Script
application/javascript 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-int-pingora-origin-digest: {"ext_ip":"172.69.68.26","ext_port":34464,"upstream_rtt":1,"upstream_reused":false,"cipher":"ECDHE-RSA-AES128-GCM-SHA256","tls_version":"TLSv1.2","cert_digest":"iPPs8Z5IjF3DGpIX/uQPdqewHtxhDZr7N5bkN+JWoGU","http_version":1}
cf-request-id: 05a032d24a00002bc647294200000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999322"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de0873079292bc6-FRA
expires: Tue, 06 Oct 2020 15:49:04 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 399 KB
113 KB 632ms
586ms Script
application/javascript 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a032d24a00002bc647296200000001
last-modified: Fri, 02 Oct 2020 04:32:28 GMT
server: cloudflare
etag: W/"63c0e-5b0a89ec6a525-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999322"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de08730792c2bc6-FRA
expires: Tue, 06 Oct 2020 15:49:04 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 25 KB
7 KB 619ms
574ms Script
application/javascript 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a032d24a00002bc647295200000001
last-modified: Wed, 26 Aug 2020 03:04:19 GMT
server: cloudflare
etag: W/"637a-5adbf1363c190-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999322"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5de08730792b2bc6-FRA
expires: Tue, 06 Oct 2020 15:57:47 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 610ms
559ms Stylesheet
text/css 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 18049
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:26 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: g1j6uUcwGHJwosICGkjPG-DESu_wV0CDRgEefQGlqXkhAUPN3UN3Jw==
expires: Wed, 07 Oct 2020 15:21:50 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 346ms
117ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jun 2020 22:05:38 GMT
Server: nginx
ETag: W/"5ee15932-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:41 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 721ms
671ms Script
application/x-javascript 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:26 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: Y3i_c8_e39GtmfSMCyQHEhJ8t4aa6uckLoNomI14_v3j3uT6DZm5Cw==
expires: Wed, 07 Oct 2020 15:21:50 GMT

GET
H2 200 ransomware.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/06/30112519/ 323 KB
324 KB 122ms
69ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/06/30112519/ransomware.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0afbc9e34f7f853e49942248d59c7feff815e9fa3b5235beb23f4f5f340c4a2b

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 12:51:32 GMT
via: 1.1 1f5757b46371746e677236d4fc67d364.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Tue, 30 Jun 2020 15:25:21 GMT
server: AmazonS3
age: 97031
etag: "428eed8e5785a032f0334dcd926eca51"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, VIE50-C1
accept-ranges: bytes
content-length: 330875
x-amz-cf-id: EKDC2AmncqqIFitpUbBSH-8LQKcj7aDm-f_s30PfDrxhgdVT6FIXag==
expires: Wed, 30 Jun 2021 15:25:19 GMT

GET
H2 200 0.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/ 10 KB
11 KB 118ms
65ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/0.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 19 Sep 2020 01:31:54 GMT
via: 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Mon, 20 Aug 2018 15:57:19 GMT
server: AmazonS3
age: 1520209
etag: "756a0525b47f4557fdfec408731afd91"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, VIE50-C1
accept-ranges: bytes
content-length: 10662
x-amz-cf-id: 1n79YkK0Z1ljDaM2UCxbsrcze0QAB24A5MB8CmpP5NDjNpAfuHfx0Q==
expires: Tue, 20 Aug 2019 15:57:18 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 89ms
36ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 08:11:35 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 1237028
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, VIE50-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: 6TNKTJCtsnTs8CWjZmxIuaQYY4B-2qmzivi6rZ7eg9l72ERlk0GIoA==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 malware-download-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/05121235/ 19 KB
20 KB 84ms
32ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/05121235/malware-download-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0b53158fac1f17ebd5a4939bd127529b81b44c261bbf65506b151ccae4071617

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 17:59:16 GMT
via: 1.1 86ef89199388021c33b079c598103b12.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Mon, 05 Oct 2020 16:12:38 GMT
server: AmazonS3
age: 78567
etag: "1c68adeae4917b89a73ad10abd2eec7d"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, VIE50-C1
accept-ranges: bytes
content-length: 19516
x-amz-cf-id: DzIl_JxTSsrH35khPlqKFPQGjYQe-A9s8NAMXbsG3l-OZsMPqjgZLA==
expires: Tue, 05 Oct 2021 16:12:37 GMT

GET
H2 200 HackBit-Ransomware-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/06/23094011/ 34 KB
34 KB 99ms
47ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/06/23094011/HackBit-Ransomware-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3bf5e5a5381944084f99c7a3bb3e2dd4771902f6aa5cbc412f412c4711fc80f7

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 22:53:23 GMT
via: 1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 13:40:15 GMT
server: AmazonS3
age: 1529718
etag: "de9a1e5b48e3adc46acf9a748a1453e0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, VIE50-C1
accept-ranges: bytes
content-length: 34786
x-amz-cf-id: THwgSjldvyNexNQ1Byh9_3QBYuTS6NzAiva08dbt4DOQdAQOhgMxaA==
expires: Wed, 23 Jun 2021 13:40:14 GMT

GET
H2 200 moneypile-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/02163301/ 46 KB
47 KB 106ms
54ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/02163301/moneypile-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e802303cf96f81f08770093330e48df04ac2a0a9776dabaadaa0c308dae9320c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 05:24:57 GMT
via: 1.1 61adf71a363fe0f836dc69dbb43de824.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Wed, 02 Sep 2020 20:33:05 GMT
server: AmazonS3
age: 1679025
etag: "396a2015732edbe5f5a1820511642785"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, VIE50-C1
accept-ranges: bytes
content-length: 47318
x-amz-cf-id: 13JUZUOZ9cK4cZlqClyLNEPFLjsm15WNoLgvA9rDa9_SwQFj_YANgg==
expires: Thu, 02 Sep 2021 20:33:04 GMT

GET
H2

404

avatar-default.jpg
i0.wp.com/threatpost.com/wp-content/themes/threatpost-2018/assets/images/
Redirect Chain

https://secure.gravatar.com/avatar/8a7bc14570dc313d735b10c591e90fba?s=60&d=https%3A%2F%2Fthreatpost.com%2Fwp-content%2Fthemes%2Fthreatpost-2018%2Fassets%2Fimages%2Favatar-default.jpg&r=g
https://i0.wp.com/threatpost.com/wp-content/themes/threatpost-2018/assets/images/avatar-default.jpg?ssl=1

65 B
65 B

423ms
361ms

Image
text/html

192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i0.wp.com/threatpost.com/wp-content/themes/threatpost-2018/assets/images/avatar-default.jpg?ssl=1
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: i2.wp.com
Software: nginx /
Resource Hash: 3a90c56bbc2ea3fae7e089cc529bc02869c5035ee31c3111d829b9ae974cf42d

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 404
x-nc: EXPIRED ams 5
date: Tue, 06 Oct 2020 15:48:43 GMT
server: nginx
content-type: text/html; charset=utf-8

Redirect headers

x-nc: MISS ams 4
date: Tue, 06 Oct 2020 15:48:42 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
status: 302
content-type: text/html; charset=utf-8
location: https://i0.wp.com/threatpost.com/wp-content/themes/threatpost-2018/assets/images/avatar-default.jpg?ssl=1
cache-control: max-age=300
link: <https://www.gravatar.com/avatar/8a7bc14570dc313d735b10c591e90fba?s=60&d=https%3A%2F%2Fthreatpost.com%2Fwp-content%2Fthemes%2Fthreatpost-2018%2Fassets%2Fimages%2Favatar-default.jpg&r=g>; rel="canonical"
content-length: 0
expires: Tue, 06 Oct 2020 15:53:42 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
1014 B 37ms
17ms Script
text/javascript 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f45068d9955109994e74e581521de618f9f6aea2414383c1aa8096eabc780ee4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 557
x-xss-protection: 1; mode=block
expires: Tue, 06 Oct 2020 15:48:42 GMT

GET
H2 200 QR-Code-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/ 8 KB
9 KB 124ms
123ms Image
image/png 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/QR-Code-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Sep 2020 19:19:50 GMT
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Tue, 15 Sep 2020 17:58:41 GMT
server: AmazonS3
age: 1801733
etag: "f2a1360e4c2d784aff00a9f87f6bb703"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, VIE50-C1
accept-ranges: bytes
content-length: 8421
x-amz-cf-id: rlP7vx-jdmO60_tD_7jzfdE3a4RSgp-FHOxNqn4aYpKzpq9XeCTL3A==
expires: Wed, 15 Sep 2021 17:58:37 GMT

GET
H2 200 botnet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/ 2 KB
2 KB 41ms
40ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/botnet-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 17:17:17 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 14:06:22 GMT
server: AmazonS3
age: 599486
etag: "985f90dddb9367ad3b074a54645a8bc3"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, VIE50-C1
accept-ranges: bytes
content-length: 1866
x-amz-cf-id: LxM4Sxcrv41EGugdPVhXveKuDuMXuIdMI_318kLBpT2dkP7U234UVg==
expires: Fri, 13 Nov 2020 14:06:19 GMT

GET
H2 200 work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/ 2 KB
2 KB 44ms
43ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/work-from-home-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 17:57:04 GMT
via: 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 17:55:32 GMT
server: AmazonS3
age: 1547499
etag: "fd4942a0704785b24b44d177f4a57d86"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, VIE50-C1
accept-ranges: bytes
content-length: 2098
x-amz-cf-id: 8J67jiqR0GzA3GggSx28r5-boavOB6RekreMt7LnLrsQLG3Qz-VnRg==
expires: Sat, 18 Sep 2021 17:55:28 GMT

GET
H2 200 zero-trust-b_w-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/ 3 KB
3 KB 41ms
40ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/zero-trust-b_w-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 14:12:42 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Mon, 07 Sep 2020 14:07:21 GMT
server: AmazonS3
age: 2511361
etag: "5fb2f76c4c77c7e774eb0dc933ab39f0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, VIE50-C1
accept-ranges: bytes
content-length: 2602
x-amz-cf-id: bFfUWx8_bXHtZW0m6q5C0oCbWkE6sd9NTE7enax59sq2tqlvZUDJ7w==
expires: Tue, 07 Sep 2021 14:07:19 GMT

GET
H2 200 social_media-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/ 3 KB
3 KB 41ms
40ms Image
image/jpeg 2600:9000:206e:3000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/social_media-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:3000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 17:24:36 GMT
via: 1.1 c7015d60d4f8f2170aaaa75e69e40618.cloudfront.net (CloudFront), 1.1 e010e3963cfd47d783f0503a3dbc3b90.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2019 15:29:14 GMT
server: AmazonS3
age: 2759047
etag: "fcf0de78ef3c45c8f8256c7cec2c35c0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, VIE50-C1
accept-ranges: bytes
content-length: 2834
x-amz-cf-id: nSeS612iafSzRdHkLzbkyi-eNlqYjdQW29SeLjB4CuInH2nuzCckEA==
expires: Tue, 25 Aug 2020 15:29:11 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 277ms
277ms Script
application/x-javascript 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: o_L4D-Get50JJBh3ZQr0z1Vyt28yiFKw9OcnasJ1nqd3rvHx1fJFcQ==
expires: Wed, 07 Oct 2020 15:21:57 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 801ms
114ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:24 GMT
Server: nginx
ETag: W/"5f7b202c-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 383ms
378ms Script
application/x-javascript 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ELVpStDGQiPOtPv0HJgmHQsL2l1cWzy-bKgrnLSYUfXJu6aB9aFYsQ==
expires: Wed, 07 Oct 2020 15:22:01 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 384ms
379ms Script
application/x-javascript 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Mon, 05 Oct 2020 13:31:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: A7ZKrHnbC6IwlwaY5eC8RRVsWQxWg83EbzoNlco8VnsUUbBOy_M9xA==
expires: Wed, 07 Oct 2020 15:22:16 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 852 B
993 B 44ms
27ms Script
text/javascript 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

185d5ff3cb0b3a389078f0bef7eb09cbb75c7e50a4047dceb2339424ba239429

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 558
x-xss-protection: 1; mode=block
expires: Tue, 06 Oct 2020 15:48:42 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 436ms
432ms Script
application/x-javascript 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=60380d88

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Wed, 10 Jun 2020 22:05:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: vntB1cNz4qXvhEEQyQLrLGV5EP_sw1MrAfHTD3ZdU8nSvSo7qr6jPg==
expires: Wed, 07 Oct 2020 15:21:51 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 115ms
113ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1604370
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: HOJZyPAPsIzzXjnAVAWVT2N4CXZVP4S6QLPWGgdEaPXmJAp4mS5oYg==

GET
H2 200 bl-04a3385-c25d996d.js Show response
tagan.adlightning.com/math-aids-threatpost/ 73 KB
21 KB 87ms
85ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 177d14d07026c975817a777e98924ad8956b20cce801ea930e95e881a7d1d19c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 02:13:31 GMT
content-encoding: gzip
age: 48911
x-cache: Hit from cloudfront
status: 200
content-length: 20978
x-amz-meta-git_commit: 04a3385
last-modified: Tue, 06 Oct 2020 02:11:38 GMT
server: AmazonS3
etag: "54769b0de5b7fe91cc67c65d743bb137"
x-amz-version-id: Peeq3XhwsdsS24Q0iEke2Y6tzBHO_iN7
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: uP7JBBjorrWiNVjpT0Nmyyk6MgmpTFqQLSBHbczSvHsa6VTD8MwVbA==

GET
H2 200 pubads_impl_2020100201.js Show response
securepubads.g.doubleclick.net/gpt/ 271 KB
96 KB 162ms
64ms Script
text/javascript 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100201.js?21067661

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

sffe /

Resource Hash

1436c906c0691c6d7e77c015f3f454e1c3df917404c2b96171d5e7e899aa3c84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 02 Oct 2020 19:05:52 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97303
x-xss-protection: 0
expires: Tue, 06 Oct 2020 15:48:42 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 199 KB
22 KB 184ms
167ms XHR
application/json 2606:4700:e0::ac40:6926
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:6926 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29257e6f0eaa20a411d881c29d9fdd181a811ec32b5fdd1cb46ec4bd4719861f

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05a032d518000017526d122200000001
last-modified: Wed, 26 Aug 2020 22:56:36 GMT
server: cloudflare
etag: W/"31bad-5adcfbb507100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601999323"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5de08734f90a1752-FRA
expires: Tue, 06 Oct 2020 15:58:42 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 109 KB
28 KB 213ms
80ms Script
application/javascript 52.84.113.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.113.143 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-113-143.sof50.r.cloudfront.net
Software: Server /
Resource Hash: 5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 18:11:03 GMT
content-encoding: gzip
server: Server
age: 77858
etag: 0ef1f140246b7e0337b522d7332711d3
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: cgQuKnZElmWevX53zX0CSvvhQCJQaKFhppJd0qaCJ9Q2IKqI33YHVg==
via: 1.1 29241b755d58e5d5a8e1a24549cddd72.cloudfront.net (CloudFront)

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/64351/ Frame D8FD
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/64351/connatix.player.dc.js

885 KB
218 KB

20ms
18ms

Script
application/javascript

151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/64351/connatix.player.dc.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c49f918947601b5ebdf5957d404b920f294237ca8e0162d4086e549f6e28d401

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
age: 18478
x-cache: HIT, HIT
status: 200
content-length: 223138
x-served-by: cache-dca17750-DCA, cache-cph20638-CPH
access-control-allow-origin: *
last-modified: Tue, 06 Oct 2020 10:07:03 GMT
x-timer: S1601999322.498337,VS0,VE0
etag: "a19f516ad4283a30153a04417b9720b8"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 428

Redirect headers

date: Tue, 06 Oct 2020 15:48:42 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-cph20638-CPH
status: 302
x-cache: HIT
location: https://cds.connatix.com/p/64351/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1601999322.477727,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 476ms
143ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1883808883&back=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 149 KB
48 KB 45ms
24ms Script
application/javascript 2a00:1450:4001:816::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5488e1362c5f2866a8717cca736567b68c675828dea25167f60dbe26661b3cc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48408
x-xss-protection: 0
last-modified: Tue, 06 Oct 2020 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Oct 2020 15:48:42 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 336ms
113ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 341ms
112ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/Y5tQ3lKwn1XL5hGgLz1kR4-1/ 340 KB
134 KB 25ms
5ms Script
text/javascript 2a00:1450:4001:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/Y5tQ3lKwn1XL5hGgLz1kR4-1/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01c3a4ce829c1fbf0971eb258b96314724a64d2c5e50b8c088f60328c4f35df1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:10:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2290
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136974
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 22:01:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 06 Oct 2021 15:10:32 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 573ms
109ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 555ms
109ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 230ms
114ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:42 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: W/"5f7b2033-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:42 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 271ms
108ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:42 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Wed, 06 Oct 2021 15:48:42 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 410ms
196ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:42 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: "5f7b2033-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Wed, 06 Oct 2021 15:48:42 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 430ms
207ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:42 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: "5f7b2033-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Wed, 06 Oct 2021 15:48:42 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 431ms
207ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:42 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: "5f7b2033-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Wed, 06 Oct 2021 15:48:42 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 439ms
210ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:42 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:31 GMT
Server: nginx
ETag: "5f7b2033-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Wed, 06 Oct 2021 15:48:42 GMT

GET
H2 200 connatix.player.css
cds.connatix.com/p/64351/ 53 KB
9 KB 19ms
18ms Stylesheet
text/css 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/64351/connatix.player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 072ab2e24f8ac0a6f43c0c0214b33e72c1f80b4cdea9503a416483a3d4cee21f

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
age: 18478
x-cache: HIT, HIT
status: 200
content-length: 8784
x-served-by: cache-dca17742-DCA, cache-cph20638-CPH
access-control-allow-origin: *
last-modified: Tue, 06 Oct 2020 10:07:03 GMT
x-timer: S1601999323.780477,VS0,VE0
etag: "3c5fd80775ec68e957c0f096c2c519f7"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 7, 454

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 549ms
108ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: W/"5f7b202e-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 335ms
113ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Tue, 13 Oct 2020 15:48:43 GMT

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame D8FD 6 KB
2 KB 523ms
145ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: 76381863ace8c482168ffc2b29df3214a64f0a950fbb4bbf1e70c94b71b7967b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
19 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 4502
date: Tue, 06 Oct 2020 14:33:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Tue, 06 Oct 2020 16:33:40 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 24ms
8ms Script
application/javascript 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 13 Oct 2020 15:48:42 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 92ms
30ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:42 GMT
content-encoding: gzip
age: 56670
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-fra19161-FRA
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1601999323.964371,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

POST
H/1.1 200
OK e Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 474ms
122ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/e
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 191ms
64ms XHR
application/javascript 52.84.113.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.113.143 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-113-143.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 12:20:32 GMT
content-encoding: gzip
vary: Origin
age: 12492
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2020 05:43:29 GMT
server: AmazonS3
etag: "a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 ec6357e657c548ad9e9ce985f638540c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: SOF50-C1
x-amz-cf-id: cNxYlMyhXXeb324otEyM38nT0mP73L9feQZJoRatu08NpISXcMCY1w==

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
355 B 228ms
156ms Script
application/x-javascript 2600:9000:203c:be00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:203c:be00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:45:08 GMT
via: 1.1 8f15499c15ad42b311a079c8ccdcc48a.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 216
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: WODBYB19WtrOqdk8XXwGYlSglIt2JUkhwW6yE3RS763M2cVfBsS31g==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
124 B 39ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&aip=1&a=1035747495&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&dr=https%3A%2F%2Fcontent.cloudflare.com%2FqKCX0Z77OR0Ii002S0Xo00i&ul=en-us&de=UTF-8&dt=UCSF%20Pays%20%241.14M%20After%20NetWalker%20Ransomware%20Attack%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=634193167&gjid=1177889468&cid=1943739475.1601999323&tid=UA-35676203-21&_gid=499816357.1601999323&_r=1&gtm=2wg9n1PM29HLF&z=88302224

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
391 B 23ms
13ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1035747495&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&dr=https%3A%2F%2Fcontent.cloudflare.com%2FqKCX0Z77OR0Ii002S0Xo00i&ul=en-us&de=UTF-8&dt=UCSF%20Pays%20%241.14M%20After%20NetWalker%20Ransomware%20Attack%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=1943739475.1601999323&tid=UA-35676203-21&_gid=499816357.1601999323&gtm=2wg9n1PM29HLF&z=578658146

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 14:47:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3656
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 16 KB
3 KB 152ms
53ms XHR
application/json 52.212.5.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=610
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.5.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-5-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a2d2e8d6b81044d75a6188598772ff45d31a562b5c737b981248aec49ec66ec8

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
754 B 103ms
38ms XHR
application/json 216.52.2.19
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 659afc50823467425ca7e8768f28a392a6ddcd93fe947e7dd32909cf83f3907c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 154ms
88ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 346ms
114ms XHR
application/json 165.227.252.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Tue, 06 Oct 2020 15:48:43 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 16
vary: Origin
content-type: application/json

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
258 B 236ms
168ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%2220a08af646a2f54%22%2C%22imp%22%3A%5B%7B%22id%22%3A%222164538077b64e9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222286cae88427f98%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2223b461f8adf1c26%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222164538077b64e9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222164538077b64e9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222286cae88427f98%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2223b461f8adf1c26%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22ref%22%3A%22https%3A%2F%2Fcontent.cloudflare.com%2FqKCX0Z77OR0Ii002S0Xo00i%22%2C%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: dbb71a92751d38f157fd81767ae5b6e6536d8c9dcd690a52036ed76554fc6da6

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
expires: Tue, 06 Oct 2020 15:48:43 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
709 B 102ms
34ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.89:80
AN-X-Request-Uuid: de1312ce-98f9-4ca0-bc00-a9110eecf680
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 172 B
558 B 161ms
76ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=2ef1513e-a8a3-4fa9-9fab-e1fd79f3e0ce%2C2ef1513e-a8a3-4fa9-9fab-e1fd79f3e0ce%2C2e35650a-e91d-4587-8582-38a25cecd865%2C120710a7-7db7-45e5-84c2-5e8f76ffb20a%2C120710a7-7db7-45e5-84c2-5e8f76ffb20a&nocache=1601999322980&gdpr=0&x_gdpr_f=1&pubcid=cc42f7e1-9bed-401c-855b-f2bef80e08b7&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash: 5e572014205666d38eb6c0cd51f9f85f5082dfd28ffdd3a31c1dda9aff598180

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
server: OXGW/16.194.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 163
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 196ms
100ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&tk_flint=pbjs_lite_v4.10.0&x_source.tid=2ef1513e-a8a3-4fa9-9fab-e1fd79f3e0ce&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5138317598180375
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 3ff5a0d6e55f27a1113753d45ae39862390111fd36fbb5a7f2f8d30345dd027d

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
3 KB 184ms
87ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&tk_flint=pbjs_lite_v4.10.0&x_source.tid=2e35650a-e91d-4587-8582-38a25cecd865&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6058372107032095
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: ca3492ecebc6ab3f883af4f90875b6fbb76fc19660f34ca64f1e5c41f4d7c60c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 1724
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 199ms
102ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&tk_flint=pbjs_lite_v4.10.0&x_source.tid=120710a7-7db7-45e5-84c2-5e8f76ffb20a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9708630890093592
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 36fb36dd285ade6c5196d3c7edd6fa9b9ea5f61e8bb2c411fa67eb19776d7a6f

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 210ms
112ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&tk_flint=pbjs_lite_v4.10.0&x_source.tid=120710a7-7db7-45e5-84c2-5e8f76ffb20a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7279270709459682
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: af74766d929dc9aa19ea0fba57bdd5ba0a7aa5f24d3d2021b4d51bba179fcb6c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2

200

ADTECH;apid=1A6962b8f0-07eb-11eb-9ff2-12a8bb4804a8;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A6962b8f0-07eb-11eb-9ff2-12a8bb4804a8;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=16...

1 KB
2 KB

143ms
143ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A6962b8f0-07eb-11eb-9ff2-12a8bb4804a8;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: a9437bf0e59fa79766e66a8798c50c21040ffdad20e43687739a8847193c2684

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1467
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A6962b8f0-07eb-11eb-9ff2-12a8bb4804a8;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=58b5733def4015b;misc=1601999322985
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A6962324a-07eb-11eb-a1d0-1273d078354a;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A6962324a-07eb-11eb-a1d0-1273d078354a;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=16...

1 KB
2 KB

155ms
154ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A6962324a-07eb-11eb-a1d0-1273d078354a;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 2f187ea1191232ace81e142232f03c6492c64d6c7e94e08756f311f2b8e34def

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A6962324a-07eb-11eb-a1d0-1273d078354a;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=59c752c190f12ce;misc=1601999322985
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A696053b2-07eb-11eb-8286-126145921f52;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A696053b2-07eb-11eb-8286-126145921f52;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=16...

1 KB
2 KB

174ms
173ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A696053b2-07eb-11eb-8286-126145921f52;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 422d3eed9bd2167f14ee53971dc5740481c118a1025c2eb1ed79f19fbe818ac0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A696053b2-07eb-11eb-8286-126145921f52;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=6043545662eb267;misc=1601999322985
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A69621c1a-07eb-11eb-9883-12724de64e5e;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A69621c1a-07eb-11eb-9883-12724de64e5e;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=16...

1 KB
2 KB

153ms
152ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A69621c1a-07eb-11eb-9883-12724de64e5e;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 459bfb9a61d6a0b1781cb35d0bbff8f32ea843b1e5321efa191d8d9cb752ed93

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A69621c1a-07eb-11eb-9883-12724de64e5e;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=618259620cbf6fd;misc=1601999322985
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A6962bfd0-07eb-11eb-9e07-128b912572ea;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A6962bfd0-07eb-11eb-9e07-128b912572ea;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=16...

1 KB
2 KB

148ms
148ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A6962bfd0-07eb-11eb-9e07-128b912572ea;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 297d8459f553cfcd439bab0536308f3b323e87b7eb9af03089480ec7d297d303

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A6962bfd0-07eb-11eb-9e07-128b912572ea;cfp=1;rndc=1601999322;v=2;cmd=bid;cors=yes;alias=62e0476e4294751;misc=1601999322985
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 780 B
848 B 395ms
159ms XHR
application/json 100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-218-250.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 43df5a24b9cc90d88dda35ce04b6683b0311b269107e2dedc4640e463096f355

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
server: Cowboy
status: 200
x-amzn-trace-id: Bids=0;Placement=dGhyZWF0cG9zdC5jb20
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 338

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
311 B 314ms
107ms XHR
application/json 35.159.48.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.159.48.82 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-159-48-82.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
710 B 98ms
34ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.137:80
AN-X-Request-Uuid: 52a36bd7-3fd8-43a3-ba1a-75536c3d27b0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
370 B 148ms
147ms XHR
text/javascript 52.84.113.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&pr=https%3A%2F%2Fcontent.cloudflare.com%2FqKCX0Z77OR0Ii002S0Xo00i&pid=KREiAHx41RRKt&cb=0&ws=1600x1200&v=7.55.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.113.143 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-113-143.sof50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
via: 1.1 29241b755d58e5d5a8e1a24549cddd72.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SOF50-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: dK9pBvGXOoiOy80q-wQpBbs68ANQT2Ec-usAh5nKxeJco1mYZOJwIw==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
453 B 46ms
15ms XHR
text/plain 2a00:1450:400c:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-35676203-21&cid=1943739475.1601999323&jid=634193167&gjid=1177889468&_gid=499816357.1601999323&_u=YEBAAEAAAAAAAC~&z=1762883093

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 06 Oct 2020 15:48:43 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
449 B 243ms
155ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Tue, 06 Oct 2020 15:48:43 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: ffebe0c405fbe80bdb7943573233fd1f
x-transaction: 0042678d00c49688
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
276 B 32ms
30ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=1943739475.1601999323&jid=634193167&_u=YEBAAEAAAAAAAC~&z=1860404867

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
513 B 52ms
30ms Image
image/gif 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=1943739475.1601999323&jid=634193167&_u=YEBAAEAAAAAAAC~&z=1860404867

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=1788995734;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM...
pixel.quantserve.com/ 35 B
371 B 9ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1788995734;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9;ref=https%3A%2F%2Fcontent.cloudflare.com%2FqKCX0Z77OR0Ii002S0Xo00i;fpan=1;fpa=P0-1813324708-1601999323160;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1601999323160;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F06%2F30112519%2Franso%2Ctype.article%2Ctitle.UCSF%20Pays%20%241%252E14M%20After%20NetWalker%20Ransomware%20Attack%2Cdescription.UCSF%20has%20paid%20more%20than%20%241%20million%20after%20a%20ransomware%20attack%20encrypted%20data%20rela%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 122ms
111ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1601904686
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Tue, 06 Oct 2020 15:48:43 GMT
Last-Modified: Mon, 05 Oct 2020 13:31:26 GMT
Server: nginx
ETag: "5f7b202e-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Wed, 06 Oct 2021 15:48:43 GMT

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 121ms
121ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 3_media.bin Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D8FD 232 B
469 B 59ms
19ms XHR
application/octet-stream 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
age: 712682
x-cache: HIT, HIT
status: 200
content-length: 204
x-served-by: cache-bwi5123-BWI, cache-cph20634-CPH
last-modified: Thu, 17 Sep 2020 01:42:41 GMT
x-timer: S1601999324.555260,VS0,VE1
etag: "796c77896c9738780ae744fd3eb73483"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 4 KB
5 KB 27ms
18ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
via: 1.1 varnish, 1.1 varnish
age: 970529
x-cache: HIT, HIT
fastly-io-info: ifsz=8114 idim=288x42 ifmt=png ofsz=4328 odim=288x42 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 4351
x-served-by: cache-dca17727-DCA, cache-cph20638-CPH
x-timer: S1601999324.540651,VS0,VE0
etag: "E00cBQTrMvE7BFKf7WtTa6oGFTVX3QMTXtfExBtu+i8"
vary: Accept
x-amz-request-id: 73558CDC7A440D38
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 196

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
890 B 38ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
890 B 37ms
15ms Script
application/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 174 KB
30 KB 592ms
541ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4142336645720677&correlator=947687110957365&output=ldjh&impl=fifs&eid=21067661&vrg=2020100201&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201006&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D63add9839f8f7dc%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D63add9839f8f7dc%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2%26hb_adid_rubicon%3D6667d534d579486%26hb_bidder_rubicon%3Drubicon%26hb_adid_nobid%3D64ffd771649374b%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.07%26hb_adid%3D6667d534d579486%26hb_bidder%3Drubicon%7Camznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D65889b01b52bb4e%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D65889b01b52bb4e%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fucsf-pays-1-14m-after-netwalker-ransomware-attack%252F157015%252F%26urlquery%3Dgoogfc%26contentid%3D157015%26category%3Dmalware-2%26contenttags%3Ddecrypt%252Cencrypted-data%252Cnetwalker%252Cpaying-the-ransom%252Cransom%252Cransomware%252Cucsf&cookie_enabled=1&bc=31&abxe=1&lmt=1601999323&dt=1601999323554&dlt=1601999321617&idt=721&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1534%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&ref=https%3A%2F%2Fcontent.cloudflare.com%2FqKCX0Z77OR0Ii002S0Xo00i&dssz=45&icsg=167785091&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=1943739475.1601999323&ga_sid=1601999324&ga_hid=1035747495&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100201.js?21067661

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

cafe /

Resource Hash

291b311ae3d3d4b7c42f0121588e0d8f35875044fd02318337f590b056b99db6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:44 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29628
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
1e153fedc91d27392c0434ac3ad9ded0.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 75ms
39ms Other
text/html 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://1e153fedc91d27392c0434ac3ad9ded0.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 32ms
10ms Other
text/html 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 118ms
118ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 236ms
118ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 2 KB
2 KB 19ms
18ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
via: 1.1 varnish, 1.1 varnish
age: 1010737
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 2066
x-served-by: cache-dca17783-DCA, cache-cph20638-CPH
x-timer: S1601999324.634083,VS0,VE1
etag: "iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary: Accept
x-amz-request-id: 9718C29D2B1AEC8D
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 2, 3

GET
H/1.1 200
OK v1 Show response
geo.ipify.org/api/ 382 B
1 KB 758ms
406ms XHR
application/json 64.140.160.2
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL

https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),

Reverse DNS

threatintelligenceplatform.com

Software

nginx /

Resource Hash

093ee8573c58af3b9ac0f59c675cd706101f7a5d67bf30d91d9ae67b8f66933e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 06 Oct 2020 15:48:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
565 B 329ms
329ms Image
image/svg+xml 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
last-modified: Mon, 05 Oct 2020 13:31:31 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: W/"5f7b2033-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: 9KgDRTlTqfdJlf8QHyPEgxof-m6FBw4btllro49ta1G0TRD4Jlc-wA==
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)
expires: Tue, 13 Oct 2020 15:48:43 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 384ms
366ms Font
font/woff2 2600:9000:2156:600:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:600:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=60380d88
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:44 GMT
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Mon, 05 Oct 2020 13:31:26 GMT
server: nginx
etag: "5f7b202e-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: yG7ECZGFx8vrmK2RiT3tgGXoue_-ePt358e_71ni3KgZ7Id8B1BOmw==
expires: Wed, 06 Oct 2021 15:48:44 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
655 B 238ms
157ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 118
pragma: no-cache
last-modified: Tue, 06 Oct 2020 15:48:43 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 93725bbcebf9f9589d3981e838b8d755
x-transaction: 00a683bb001899c4
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame E2D8 0
0 31ms
31ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=standard&size=normal&cb=nvz9kj3j62mm

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nVcPZk5OpWcWLsuWUer7Tg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=standard&size=normal&cb=nvz9kj3j62mm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 06 Oct 2020 15:48:43 GMT
content-security-policy: script-src 'report-sample' 'nonce-nVcPZk5OpWcWLsuWUer7Tg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10820
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 prebid3.25.0-1.js Show response
cds.connatix.com/p/plugins/ Frame D8FD 286 KB
89 KB 20ms
19ms Script
application/javascript 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
age: 1922680
x-cache: HIT, HIT
status: 200
content-length: 90468
x-served-by: cache-dca17743-DCA, cache-cph20638-CPH
access-control-allow-origin: *
last-modified: Mon, 14 Sep 2020 09:43:49 GMT
x-timer: S1601999324.734681,VS0,VE0
etag: "9c38c88a790efaae20de0f5391a27029"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 1088

GET
H2 400 / Show response
graph.facebook.com/ 202 B
582 B 49ms
34ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3ae2cde51f29a107125075bf92c00e55c5445102facff74bfb9488f894ae4088

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002776387
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 150
pragma: no-cache
x-fb-debug: aYOWEDon1UFZHF14+SEe3qQCKhXpea2Im1h4rCD36RecNVL13UtAJ3eWNhixLYQlh4R6WU+nCaNgM3zbJvrB2A==
x-fb-trace-id: DRfg7Mo6P3n
date: Tue, 06 Oct 2020 15:48:43 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AZ80ma0IL4_VBsqmre4Z0_8
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 199ms
182ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F&format=jsonp&callback=jQuery1124023483939350534322_1601999322427&_=1601999322428
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 255ms
164ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame E38E 0
0 32ms
31ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=light&size=normal&cb=1jtv1lrk8lnn

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-G51Hp9Q8zcI1WcvPF70wNg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&theme=light&size=normal&cb=1jtv1lrk8lnn
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 06 Oct 2020 15:48:43 GMT
content-security-policy: script-src 'report-sample' 'nonce-G51Hp9Q8zcI1WcvPF70wNg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 11102
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D8FD 309 B
326 B 19ms
18ms XHR
application/x-mpegurl 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
age: 490826
x-cache: HIT, HIT
status: 200
content-length: 164
x-served-by: cache-bwi5122-BWI, cache-cph20634-CPH
last-modified: Mon, 07 Sep 2020 18:49:42 GMT
x-timer: S1601999324.776101,VS0,VE0
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame D8FD 92 B
282 B 88ms
87ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=29f919ec-fcd1-4e15-9d49-f7c17b866ace&nocache=1601999323793&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
via: 1.1 google
server: OXGW/16.194.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame D8FD 19 B
709 B 47ms
47ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.26:80
AN-X-Request-Uuid: 669acbb6-25bb-4395-96df-f47129baa02e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame D8FD 92 B
285 B 76ms
75ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=9290fb26-938c-4cf8-9039-b65782a5085b&nocache=1601999323798&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:43 GMT
via: 1.1 google
server: OXGW/16.194.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame D8FD 19 B
709 B 35ms
35ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:43 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.75:80
AN-X-Request-Uuid: 208868ee-a5f0-4821-9f44-7db37fa17005
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET cygnus
as-sec.casalemedia.com/ Frame D8FD 0
0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame D8FD 0
59 B 81ms
81ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame D8FD 0
215 B 149ms
50ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame D8FD 25 B
437 B 247ms
185ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2215627038aaecc16%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2216f1722d3607625%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a9ad536e6c2dbac817e0d88268a5dfa9d80263b80b1d4265681b82aad31c641e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:44 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Tue, 06 Oct 2020 15:48:44 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame D8FD 0
59 B 78ms
78ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:43 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 0.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D8FD 5 KB
1 KB 24ms
23ms XHR
application/x-mpegurl 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
content-encoding: gzip
age: 710134
x-cache: HIT, HIT
status: 200
content-length: 959
x-served-by: cache-bwi5123-BWI, cache-cph20634-CPH
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
x-timer: S1601999324.843189,VS0,VE1
etag: "3a71266b043248350b2f39a55da8294e"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 18ms
18ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 06 Oct 2020 15:48:43 GMT
x-served-by: cache-cph20634-CPH
x-cache: HIT
x-cache-hits: 0
x-timer: S1601999324.876984,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D8FD 1 KB
2 KB 20ms
18ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-1428

Response headers

date: Tue, 06 Oct 2020 15:48:43 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 710134
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5122-BWI, cache-cph20634-CPH
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 0-1428/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1601999324.896486,VS0,VE1
access-control-allow-origin: *
Content-Length: 1429
x-cache-hits: 1, 1

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 52ms
52ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 06 Oct 2020 15:48:44 GMT
x-served-by: cache-cph20634-CPH
x-cache: HIT
x-cache-hits: 0
x-timer: S1601999324.014286,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D8FD 444 KB
445 KB 19ms
19ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=1429-456334

Response headers

date: Tue, 06 Oct 2020 15:48:44 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 710134
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5122-BWI, cache-cph20634-CPH
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 1429-456334/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1601999324.067480,VS0,VE0
access-control-allow-origin: *
Content-Length: 454906
x-cache-hits: 1, 2

GET
H2 200 bframe
www.google.com/recaptcha/api2/ Frame 1C11 0
0 23ms
23ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=iw1119hyn79g

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fdJkmTQWuK1x2uAx/LmYlQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=iw1119hyn79g
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 06 Oct 2020 15:48:44 GMT
content-security-policy: script-src 'report-sample' 'nonce-fdJkmTQWuK1x2uAx/LmYlQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1173
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-04a3385-c25d996d.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 03DD 73 KB
21 KB 98ms
97ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 177d14d07026c975817a777e98924ad8956b20cce801ea930e95e881a7d1d19c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 02:13:31 GMT
content-encoding: gzip
age: 48913
x-cache: Hit from cloudfront
status: 200
content-length: 20978
x-amz-meta-git_commit: 04a3385
last-modified: Tue, 06 Oct 2020 02:11:38 GMT
server: AmazonS3
etag: "54769b0de5b7fe91cc67c65d743bb137"
x-amz-version-id: Peeq3XhwsdsS24Q0iEke2Y6tzBHO_iN7
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 1HCZ60apjB-DlkBMn85buAY7R_BfA49FzZOY_JgZD2teFGESvGoNCQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 03DD 61 KB
21 KB 80ms
79ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1604372
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: d1Qeie0yGZ4wwLmtxIFM6TKhzNlBZkeoZJzU3RZlw3PnPP8u6J-SJg==

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame DBA7 0
0 25ms
24ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=ucg56asa7816

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yO21a94SVweUiQ7AQYSGeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=Y5tQ3lKwn1XL5hGgLz1kR4-1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=ucg56asa7816
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 06 Oct 2020 15:48:44 GMT
content-security-policy: script-src 'report-sample' 'nonce-yO21a94SVweUiQ7AQYSGeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1172
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-04a3385-c25d996d.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 8E94 73 KB
21 KB 79ms
78ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 177d14d07026c975817a777e98924ad8956b20cce801ea930e95e881a7d1d19c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 02:13:31 GMT
content-encoding: gzip
age: 48913
x-cache: Hit from cloudfront
status: 200
content-length: 20978
x-amz-meta-git_commit: 04a3385
last-modified: Tue, 06 Oct 2020 02:11:38 GMT
server: AmazonS3
etag: "54769b0de5b7fe91cc67c65d743bb137"
x-amz-version-id: Peeq3XhwsdsS24Q0iEke2Y6tzBHO_iN7
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: XGXLjpXzm3YFqcKxZq7mZJhev20SPlIpOx1v0JBQz-AxyDC4c67fNA==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 8E94 61 KB
21 KB 79ms
78ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1604372
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: lGYMH2lV2UX30JS6wUyvuV1dyck6jC2uv8sYejUQAqWmD3DP7RmT1w==

GET
H2 200 bl-04a3385-c25d996d.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame FD04 73 KB
21 KB 86ms
85ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 177d14d07026c975817a777e98924ad8956b20cce801ea930e95e881a7d1d19c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 02:13:31 GMT
content-encoding: gzip
age: 48913
x-cache: Hit from cloudfront
status: 200
content-length: 20978
x-amz-meta-git_commit: 04a3385
last-modified: Tue, 06 Oct 2020 02:11:38 GMT
server: AmazonS3
etag: "54769b0de5b7fe91cc67c65d743bb137"
x-amz-version-id: Peeq3XhwsdsS24Q0iEke2Y6tzBHO_iN7
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: LTYZdukRRIwdllTBNgKSIFwP9DHrkwkzeQECebkH_FNpBDff7lr3Fw==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame FD04 61 KB
21 KB 86ms
86ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1604372
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: w7UKd7TFRv1yxyTHQe7VItgxb4Detis7L3R4-8QBsBc8tuc_S85mYA==

GET
H2 200 bl-04a3385-c25d996d.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 440A 73 KB
21 KB 82ms
80ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-c25d996d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 177d14d07026c975817a777e98924ad8956b20cce801ea930e95e881a7d1d19c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 02:13:31 GMT
content-encoding: gzip
age: 48913
x-cache: Hit from cloudfront
status: 200
content-length: 20978
x-amz-meta-git_commit: 04a3385
last-modified: Tue, 06 Oct 2020 02:11:38 GMT
server: AmazonS3
etag: "54769b0de5b7fe91cc67c65d743bb137"
x-amz-version-id: Peeq3XhwsdsS24Q0iEke2Y6tzBHO_iN7
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: I0YBF-P0WwYiiVPSCETZEuzqbWiZ9KOQ3QRo6yO43ndoffj2F4_nhA==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 440A 61 KB
21 KB 82ms
80ms Script
application/javascript 52.84.112.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.112.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-112-89.sof50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:09:13 GMT
content-encoding: gzip
age: 1604372
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 17bed89dd77d46d0468ee87c1955e451.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: SOF50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: vDl0qjs49NKEshDW4Ns6c5BmOCx1HD1pShjkW7teFw5s6ZgTQYjKBA==

GET
H2 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 440A 330 B
494 B 9ms
7ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 04 Oct 2020 17:40:53 GMT
x-content-type-options: nosniff
age: 166071
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Oct 2021 17:40:53 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201001/r20110914/ Frame 440A 18 KB
7 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201001/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93ee1cf33c2f89ea4b40725a3fa6e12ef339841146b9725bab9d7607afd25f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 14:38:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 4444408978987076335
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Oct 2020 14:38:35 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201001/r20110914/client/ Frame 440A 3 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201001/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87adcd951526f566dd8a1eb655a8c4736a3bad8167f6e09a255e54650aeeb655

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 14:37:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4246
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1330
x-xss-protection: 0
server: cafe
etag: 15429208973290199181
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Oct 2020 14:37:58 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 440A 74 KB
28 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e065984f0b5379a6b11ab4dc497fe57f7b56efd8326952d59ae1d57566e9fe4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601897795664432"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28872
x-xss-protection: 0
expires: Tue, 06 Oct 2020 15:48:44 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 440A 0
0 14ms
13ms Image
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSqsoGiuvDL7yoQkbKm5PFHI-8iZ-ipopDu0QRS1Ved5VXTr6XR4wujHDL7F294f82cce9o
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100201.js?21067661

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6879bf69ca14159cb61c4420c496946a303da8a9a37f6e0b4f4e12e79cbbf06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601897795664432"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27576
x-xss-protection: 0
expires: Tue, 06 Oct 2020 15:48:44 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012009282107000/ Frame 03DD 206 KB
57 KB 93ms
5ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57253
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0138da5df6f877a3"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 03DD 16 KB
6 KB 106ms
19ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-ad-exit-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5763
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0dd94cdacc228659"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 03DD 96 KB
29 KB 104ms
17ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-analytics-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29503
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "59cc65a87e598f8b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 03DD 4 KB
2 KB 103ms
16ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-fit-text-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1805
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d5686bc7b82e539c"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 03DD 47 KB
14 KB 101ms
14ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-form-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9099
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14600
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a6f012caf7a1c6f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:05 GMT

GET
H3-Q050 200 3460695272073842029
tpc.googlesyndication.com/simgad/ Frame 03DD 82 KB
82 KB 113ms
15ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3460695272073842029?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlLQOkOFJb7hgCozmsfuQ92iMwLPA

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c048a2d946f5162740622113b001ac16c4667d801eb79b1d834d1e499fbaac3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 04 Oct 2020 17:24:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Sep 2020 08:47:06 GMT
server: sffe
age: 167026
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84202
x-xss-protection: 0
expires: Mon, 04 Oct 2021 17:24:58 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 03DD 2 KB
3 KB 112ms
14ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 16786
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 03DD 295 B
756 B 112ms
13ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Oct 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 66106
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Oct 2020 21:26:58 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 03DD 0
0 138ms
100ms Image
text/html 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C33WP25F8X-n_KoGlrATvw6vIDOybs65f7O_1sJ0M29keEAEg0YfSIGDRgbmC0AegAabIg8wCyAEC4AIAqAMByAMIqgTSA0_Qv89AyK1wHm0jUwzogZo9ptnMx6-w6UcIcF-tQqnqJ4AcLC6N1eHG52AloBa22BX0jsr_iTo2L_l56k-_F6eF_Z3GVKKd8lomze2yBSGVP-1WtMEJ88PhTHVK7nRlT0icVq7WyoTZ_6n4X-ETW0ejV0xM6nisdKb_wn5w1xTWZp5lWHSGkJysI8ncQbE1LoGTXslcM2RHG9KgECvfqEtCB1F_4PXHWmlLSkQHEeYBIjNku-O8uwA4GXN8sy3gYTj705Tgs9Mj5V-PgToLTgXGNzrSb8X9Zx7wkteQ3pqdK6URLQWQlVT7Crz_Nq30g9zEc5faod-nndNbFYPu5DpDwxNo1eYF9NqR3tW2gJyJZhLXSX-qYBybkasryJ_yPn0sctJkyIGNnrCvdAT_1EUTRHuAmKez0-xOyKqEmRJLMgorysP3wkEWPmwgAXfykXjMLe226O-ZpuuXQiEzHocqLq4GhTVapn1q0tyHGbbBmeBso5IbLzrE1fER2bCCnr7B8IsIue4FgS0o1_6m9Tq5Wb4hRP2ModqCflDc7IKvSfVc4OMLeKqiUIBtV09GkdI9r1H3PHmdGZDfHjSisP9xrYxXs25bfMQJOEjxumUsDPfABLetr-uCA-AEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAfCt_yzAagHjs4bqAfVyRuoB5PYG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCT0hHSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwGyDBRwdWItOTY4NTczNDQ0NTQ3NjgxNNgTDA&sigh=J7KlRfN6ssk&tpd=AGWhJmvtp7LLW2Nea4h5N9EpTnj4x3pnf7R9Digd8jJKEGYNbg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.23.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s18-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 03DD 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b522411ab157c6297f7523bb36c55fbb17f8e2bce8ab3fd5bd66a828186e5837

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012009282107000/ Frame 8E94 206 KB
56 KB 67ms
46ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57253
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0138da5df6f877a3"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 8E94 16 KB
6 KB 64ms
44ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-ad-exit-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5763
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0dd94cdacc228659"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 8E94 96 KB
30 KB 63ms
44ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-analytics-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29503
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "59cc65a87e598f8b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 8E94 4 KB
2 KB 64ms
44ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-fit-text-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1805
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d5686bc7b82e539c"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame 8E94 47 KB
14 KB 64ms
45ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-form-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9099
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14600
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a6f012caf7a1c6f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:05 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8E94 5 KB
738 B 60ms
36ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Oct 2020 14:46:31 GMT
server: ESF
date: Tue, 06 Oct 2020 15:48:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Oct 2020 15:48:44 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8E94 5 KB
1 KB 60ms
36ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Oct 2020 14:36:53 GMT
server: ESF
date: Tue, 06 Oct 2020 15:48:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Oct 2020 15:48:44 GMT

GET
H3-Q050 200 17712386511653973323
tpc.googlesyndication.com/daca_images/simgad/ Frame 8E94 35 KB
35 KB 12ms
9ms Image
image/jpeg 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/17712386511653973323

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf8daa3513ab91f20f94b51c085a6c0f33eb40311def4870c989b6c921c30da2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 04 Oct 2020 06:24:09 GMT
x-content-type-options: nosniff
age: 206675
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36196
x-xss-protection: 0
last-modified: Wed, 08 Feb 2017 18:57:13 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Oct 2021 06:24:09 GMT

GET
H3-Q050 200 40933678460698624
tpc.googlesyndication.com/simgad/ Frame 8E94 1 KB
870 B 10ms
7ms Image
image/svg+xml 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/40933678460698624

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 15:07:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88849
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 728
x-xss-protection: 0
last-modified: Thu, 26 Oct 2017 18:18:20 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Oct 2021 15:07:55 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 8E94 0
0 74ms
71ms Image
text/html 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C0K9J25F8X-r_KoGlrATvw6vIDJ2N3qZf9K_jz4oMwI23ARABINGH0iBg0YG5gtAHoAGKp8eZAsgBAakCBWVFw1PHsz7gAgCoAwHIAwqqBM8DT9AzF3zZ2MjsVtout1vEzTg_LwJ6QF33dTp0qtkq2APKgETLBPiry_g7W88XbMF47ozJQZITkBZymuJOAaNh6SGElkOSoAraFre902-z1RHrSg9wjH45D2LmkgrMXoTy3FCYCUVQTzksxrnj8jwIp3LXSrVODD2cLe3rMNaVOqsBQMXcUXJe2yTIjB47T-Mah3DwwYzTd7gbfBy93kmclJ5LQoSv5WXXMIEzmmUzg9BUYgUV12KK8cyDGSzmcUDTNcu0FIBjtSU9EP-Qs3ksOk25tqAXfldFWqA7HDhTHiLmv-0XS8gAwQcimOSsAxDr1x_qOVhEBLEyFMdT-His4sqRbY6qCkM-lm_JwP4PWgXH8k2i5wLAcwhqXHJRyr0FRUGLE1sjomLrB7ubEsVLIuyZF1vORHfww4Sm-Dwz1LVapmM6PL6sMX2acAEYfUYU6AJq7Rf0CO7e-Jnrg_kZa-JtaKbXoaXgDPWbyh6mXIeJ39jB2mESo2fuFosY8-JsZbyrFNiv3dGTx0tRSW4dDUEO69mPHYR-LN4vGN1z4TU2t2xTYTO9E2KZy9bwg-C9aty6H_pcF9wezGsOalCERWNxtd0MUzxJBMVou6QaA8AE4fW__psD4AQBkgUECAQYAZIFBAgFGASgBlGAB97YuOYBqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEJjDFNIICQiA4YBAEAEYHfIIG2FkeC1zdWJzeW4tNzI2MzU3MzQ0NjgwNDA3OIAKA8gLAbIMFHB1Yi05Njg1NzM0NDQ1NDc2ODE02BMK&sigh=MwYZW20UkYY&tpd=AGWhJmvOJqweaEBk8tCKeYYGS1lvUQORoaz5eHOzmiM9itZh7w
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.23.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s18-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E94 2 KB
2 KB 11ms
8ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 16786
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E94 295 B
319 B 12ms
9ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Oct 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 66106
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Oct 2020 21:26:58 GMT

GET
DATA 200
OK truncated
/ Frame 8E94 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31bef33672e71e0ebe8cac503763880c632c55bc4e0c3c8a37b0d9bc1d4e3957

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012009282107000/ Frame FD04 206 KB
56 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57253
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0138da5df6f877a3"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame FD04 16 KB
6 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-ad-exit-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5763
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0dd94cdacc228659"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame FD04 96 KB
29 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-analytics-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29503
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "59cc65a87e598f8b"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame FD04 4 KB
2 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-fit-text-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9101
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1805
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d5686bc7b82e539c"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:03 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012009282107000/v0/ Frame FD04 47 KB
14 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012009282107000/v0/amp-form-0.1.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9099
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14600
x-xss-protection: 0
server: sffe
date: Tue, 06 Oct 2020 13:17:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9a6f012caf7a1c6f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Oct 2021 13:17:05 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FD04 2 KB
2 KB 11ms
9ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 16786
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FD04 295 B
319 B 11ms
9ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Oct 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 66106
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Oct 2020 21:26:58 GMT

GET
H3-Q050 200 14022255765504553071
tpc.googlesyndication.com/daca_images/simgad/ Frame FD04 67 KB
67 KB 12ms
10ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/14022255765504553071

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4679b77bc0b273162881f1fb2fdd721cba182d7b554e56ab962f27745f34b542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 08:23:07 GMT
x-content-type-options: nosniff
age: 285937
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68881
x-xss-protection: 0
last-modified: Fri, 29 Jun 2018 22:02:43 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Oct 2021 08:23:07 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame FD04 0
0 17ms
15ms Image
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQTJ-xWeZ6_ly5-Hk9kJm9fDuQnPoSMZPieNOnzyKS7Q3irQbHA66IoU4-0kmP9RJCW8PdQ
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame FD04 0
0 86ms
85ms Image
text/html 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CTx3U25F8X-v_KoGlrATvw6vIDOKW7cZfkPLgld0M59LjsJIMEAEg0YfSIGDRgbmC0AegAYeEku8DyAECqQKK17hrKUSFPuACAKgDAcgDCKoE0gNP0NtczYFE75b9oq-aAu8xMN_CB6Vehgf9_ZM1cVDXTPK5cvYTM5fuFK-cF9PQGC2moBBVJhNME73xgfk1bRriI4HN2g_QBnjJk4rf6HXFB3BtbI405KA4k0RQJZYG-ZqHe2yDem7QeM8T7Dlhev7fL2a6vvwHsDudt_pRHPdTW8EPIlVJ_XOXp9YxrZo7W1JWImexj0R1Cu5wpHNBywxqT2zBjW-2OZK5v8DYM4dvWMQv3I2df7w8PI6VrN6KlfRGLvBu7ymjO9UiISjnLsO8GR_e0kRKCrHFJPR9rEXoIl_caJU5GJQexv-njipSUkXNOofcQkMehLdjZiE0leIlpjurYZv5ig-cGM9U8F8PldROgZ1GPo7N92yd2KVbS-XoiS3O80mNUYu3T8QzSSgIO4NFT2s_ZWe_a77M4b-IE1cXYoIgcjmsbvM0oVHl8MW8x881N0anriTzYfpaXPkkwBwB_QpxhM_Gg3q47bBBt13bcwDP27trwOSH0KcI-I-xe6t1GbZGIn3HZil_Vhp90gRLTB1VUWuBJVycbOSdUYZVu1TZvA1ss3T60lRvQHmjAIlLzvZnUQ4MIHXr7bchXaBrBwYayqLDjGhzJeoTZ-ePwASk4um8ugHgBAGSBQQIBBgBkgUECAUYBKAGAoAH4fvtEKgHjs4bqAfVyRuoB5PYG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBDN1BLSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwGyDBRwdWItOTY4NTczNDQ0NTQ3NjgxNNgTDQ&sigh=yKgQwXPCGys&tpd=AGWhJmuJvTdSVc03R09pP28Kjl2KtJC7uoAX7fx634pzfj37cw
Requested by: Host: threatpost.com
URL: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.23.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s18-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame FD04 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d12fa14ecd6446d9792031fb86a9b423611cf94c208d028a391a56f985919fd

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 440A 0
0 67ms
66ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssGkuOh6RTFBwHnXeAMFRF-Xov7cIxFmCUd6C96bBI3FvnzjgAj7rvnzuB7DeazkEjxus8z4tUmSh9CILjSJG2C3KKOlUNW0k0amv-Ma-x3LBQjhKQ0mTHBqbgCltiXt_eLZL6mnBRLuuiEA5URkWlMWS37eSCwa2TDhlGUQgZrJv2S3Y3bu6OFKqMO-nzwo6SpYM1heJSv9kCcDMYH1hOjlslBmUxZGvxIlJOGMH5-wJJTbgOu3vJAnacUUj8sOjvuR-St1DjT1Fzn-7QUCA&sai=AMfl-YTSlHy31QLXY2I5jTenUvUyJ1u8ewD2E7MJUBaUCROqctO4Tfn8h4M70uDdQ8WpbV3ntgu3Y2SRQJl0lI2o7YmbAF738lY-ZGghZbAvGm8ftaPvHuIiS2r7EGQneoI-&sig=Cg0ArKJSzF7skIphPd03EAE&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 15:48:44 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 440A 0
21 B 68ms
67ms Image
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss-JvrLWNsus9XcKS0i4BnioAEtqB1cRNi2R3R0Cq0IRtDERPE8eGZXwu8mYciTumkOJ8PfAuHTqEq2agfgd9hyqYbbeK9w6TQv40WRVyBbTNuIz5sln4QostAvR_nakerycfEfBF3g_8R5n8SzTohT2A3sFMig78yQammSHN364_qk1eu8X8KjIZWF56cnJAOffcOUNLLaI9Fr6s5Wd3elHtAaJZRbfKLmg9lDETpv4_0MRK2VX0CwQOJJlSRuMuK828TOY26mG94XW8CQSAgT&sai=AMfl-YSCk6Pdt5zL6ovofEO6nX_DJuB8YbTE_0Gui7euFICmQBrMIRAavQ3Mz5wEtHHWJrgrZRID75sdXE2SXlde3JBpP5MTFNcYN4oh3iPBnWMaOJKwaTiaX1ntcEy-3L1D&sig=Cg0ArKJSzNd4xlPUP1K1EAE&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 15:48:44 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 440A 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 317b4a661a4243be85ae462fc23a937bea4e7176d6a1ac64a6c4f3b2c66296b5

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 8E94 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 11:04:06 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 103478
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Tue, 05 Oct 2021 11:04:06 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 8E94 11 KB
11 KB 28ms
13ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 14:47:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 3652
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Wed, 06 Oct 2021 14:47:52 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 03DD
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

40ms
38ms

Image
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Tue, 06 Oct 2020 15:48:45 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 8E94
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

40ms
40ms

Image
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Tue, 06 Oct 2020 15:48:45 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 39ms
18ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020100201&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100201.js?21067661

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

351abe188a4ddd1117db403ebb5ec68dd848b9abee1838461c0d1bb498284ed2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 15:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6487
x-xss-protection: 0

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame FD04
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

56ms
53ms

Image
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Tue, 06 Oct 2020 15:48:45 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 118ms
118ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:45 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-Q050 200 3460695272073842029
tpc.googlesyndication.com/simgad/ Frame 03DD 82 KB
82 KB 7ms
6ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3460695272073842029?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlLQOkOFJb7hgCozmsfuQ92iMwLPA

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c048a2d946f5162740622113b001ac16c4667d801eb79b1d834d1e499fbaac3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 04 Oct 2020 17:24:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Sep 2020 08:47:06 GMT
server: sffe
age: 167027
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84202
x-xss-protection: 0
expires: Mon, 04 Oct 2021 17:24:58 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 03DD 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 16787
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 03DD 295 B
324 B 7ms
7ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Oct 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 66107
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Oct 2020 21:26:58 GMT

GET
H3-Q050 200 17712386511653973323
tpc.googlesyndication.com/daca_images/simgad/ Frame 8E94 35 KB
35 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/17712386511653973323

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf8daa3513ab91f20f94b51c085a6c0f33eb40311def4870c989b6c921c30da2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 04 Oct 2020 06:24:09 GMT
x-content-type-options: nosniff
age: 206676
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36196
x-xss-protection: 0
last-modified: Wed, 08 Feb 2017 18:57:13 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Oct 2021 06:24:09 GMT

GET
H3-Q050 200 40933678460698624
tpc.googlesyndication.com/simgad/ Frame 8E94 1 KB
760 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/40933678460698624

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 05 Oct 2020 15:07:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88850
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 728
x-xss-protection: 0
last-modified: Thu, 26 Oct 2017 18:18:20 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Oct 2021 15:07:55 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E94 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 16787
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E94 295 B
319 B 7ms
6ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Oct 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 66107
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Oct 2020 21:26:58 GMT

GET
H3-Q050 200 14022255765504553071
tpc.googlesyndication.com/daca_images/simgad/ Frame FD04 67 KB
67 KB 9ms
6ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/14022255765504553071

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4679b77bc0b273162881f1fb2fdd721cba182d7b554e56ab962f27745f34b542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 08:23:07 GMT
x-content-type-options: nosniff
age: 285938
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68881
x-xss-protection: 0
last-modified: Fri, 29 Jun 2018 22:02:43 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Oct 2021 08:23:07 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FD04 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 16787
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FD04 295 B
319 B 8ms
6ms Image
image/png 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Oct 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 66107
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 06 Oct 2020 21:26:58 GMT

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ef0cc99ae155124895f712a9b68285f7b0a8c3f3c151e86107a25b61cf22085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601061966610483"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6293
x-xss-protection: 0
expires: Tue, 06 Oct 2020 15:48:45 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/217/ Frame 0639 0
0 6ms
6ms Document
text/html 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/217/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/217/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4867
date: Tue, 06 Oct 2020 15:03:02 GMT
expires: Wed, 06 Oct 2021 15:03:02 GMT
last-modified: Mon, 21 Sep 2020 23:28:38 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2743
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
223 B 40ms
40ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=217&t=2&li=gpt_2020100201&jk=4142336645720677&bg=!wcKlwtpYuMVKVMWC-S0CAAAAWlIAAAAPCgD20jyV6l7YzLGz-FWwWXn959-7TR286usZbPg9yn46hHLqhD5gIVb-fN15QuElvNXnIWXw1blEWgLLukhORj1Rh4jGca8rTvRfNIf9kPHUS0p6zE9oRBCo5GjWVRgjKrr4rOGuGQExHBqlTM-HLMXWvXQhSq0zcTqDVpMMcIQcJbM91tTpweTlo3R5Dk0Q1hTEJCaIK8sNGj6M5fjb1tYNFEPcezgJOLbFCPJTZ7UuN7ImjI9GCPZI2WQGbySxYJQpRMyU3XyZEJTJGX-phrfUckrfVE8hhVxlR6xgXxtpO7Vt1X3L2gOyHDkd10EpqfIWFfxkc5gcmQGn4_X9PRgRI0U1WRdRUKY4kiWGrf4ZZl6fLP6BrTeLhTiIEH8ZhVZ4qd3smoRYp_fqdoapI3-9O31R6V66X14Z1r_r20MibfdELKTpnchw7OcP6FeEUrMZreBek7kxKQVTLpyO9K7eSZAMjvKGZ2JP_DB9LRJTpVKSyIHEJKyrVVJkMDC90RNMX2GneSuauRl8pklr3A_Q-mFegYMLhP1vyFMaNUg3R7bc7wmRg21CuBMUpMaf66ACeUdm7QGjOTKjfraeIm7VKEg1_ExKif0QHdYusI3c-3sBH9tNYsQ-7rzp1OAEjw-sOsVyHFidBn0kPSTPBihcc_4hZwaxOZMlp_fRAboO4Jm6f1qL64aAdK61D-hwlPQ3Nx45xE0D3m20VXd7QZc5wDCIeyCeq1kXDXOHB15VzVFx8UnpdttRF-6G4URwOihG1q4DBE7qDbLdyaGCkf9mkGv1ur8aLAD_PNkmre6bBLUL0O-yzk9fAKNII0VCMe8YeFDOqU99bxQXRvZfEKN7I5xsbajvqFPBvQt4WhUUtfSV7RUDhP5rg8-M5r4B5jpX

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 118ms
118ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:45 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 18ms
18ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 06 Oct 2020 15:48:46 GMT
x-served-by: cache-cph20634-CPH
x-cache: HIT
x-cache-hits: 0
x-timer: S1601999326.143039,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D8FD 390 KB
390 KB 19ms
19ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=456335-855191

Response headers

date: Tue, 06 Oct 2020 15:48:46 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 710136
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5122-BWI, cache-cph20634-CPH
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 456335-855191/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1601999326.161916,VS0,VE0
access-control-allow-origin: *
Content-Length: 398857
x-cache-hits: 1, 3

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 8E94 42 B
268 B 42ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvZv-2ZbQXupGVtvl-sWKw6WsaxNgfr9c02P-vkqNRtaj-EP91MPN4A_PKFHCZlylG2CxGb7DV8ogFN7nyI_sMzEV-bhh9PfGUOqoeoqjNBmFGKqcTjQ23_1dzsQ&sai=AMfl-YTeBib8-cm4G8fGmsWM7XVNSFnfvF_1CZoifqexeVsNVI-WJBlu0xOIs30iF7xRpnjRpw7DeeL3oKg7GuobFdj59lgmoakKDNiQfu9PrR0RsiLsAXR5aJmyCa80DV9o&sig=Cg0ArKJSzOWoEFqpltZ-EAE&cid=CAASPeRof4wfBFbYwMsv4019QJsG3j7ynNkuWISJ64tQ0A6gBUOrlCzzZF7n1Qai5fPKh1GM715aWuPr8zRIg_Q&id=ampim&o=1064,417&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=251&tls=1252&g=100&h=100&tt=1252&r=v&avms=ampa&adk=654286612

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 03DD 42 B
107 B 41ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuKx3ieCRPY2z6rTtA3sfQ-JMVYnTmv2Z4Bia6-3ixiOGn007YANjuOONTEKkc6BzTyS2fVEdlYFVgcLAtTqvDWEikDvxzPN50_AuW-QKoPz32RGrjKhTxicgkE_w&sai=AMfl-YQcVGL4lHiAGy-KWh_2YLDMW9ezmbU4Xf61CndDaqJALFyzMxGKP4QzQRiZg_goaD51aVZ-Un2Na164KfrXS5woA88FSeUoy7BH7GSsKu9SFFMEKGczB1wbb081ag7L&sig=Cg0ArKJSzNK0Dje1EVLuEAE&cid=CAASPeRoZRlqresQQUwi5EhyIvkcWFpSDY3iHkcZHawKcLsA_3WpJm-X08Vl2Igah3-cjScKi4Hq9wgmTDPUZ3k&id=ampim&o=315,10&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1003&mtos=0,0,0,1003,1003&tos=0,0,0,1003,0&tfs=292&tls=1295&g=100&h=100&tt=1295&r=v&avms=ampa&adk=1015519800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 0DC7
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

301ms
79ms

Document
text/html

205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

Date: Tue, 06 Oct 2020 15:48:47 GMT
Connection: Keep-Alive
Cache-Control: max-age=11365
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx000000000000000a2036d-005f7b6cc3-3ee9a51-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1601999327.dop001.sk1.t,1601999327.cds029.sk1.shn,1601999327.dop001.sk1.t,1601999327.cds036.sk1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame E122 0
0 207ms
78ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Thu, 24 Sep 2020 16:43:28 GMT
Content-Encoding: gzip
Content-Length: 9446
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=86073
Expires: Wed, 07 Oct 2020 15:43:19 GMT
Date: Tue, 06 Oct 2020 15:48:46 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

sync
eb2.3lift.com/ Frame B0EA
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

82ms
73ms

Document
text/html

35.158.206.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.206.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-206-167.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=17515234874874901785
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
date: Tue, 06 Oct 2020 15:48:46 GMT
content-type: text/html; charset=utf-8
content-length: 466
set-cookie: sync=CgoIgQIQ2pzn9M8uCgoIoQEQ2pzn9M8uCgoI4gEQ2pzn9M8uCgoI5gEQ2pzn9M8uCgoI1gEQ2pzn9M8uCgoIhwIQ2pzn9M8uCgkIOhDanOf0zy4KCQgLENqc5_TPLgoJCF8Q2pzn9M8uCgkIHxDanOf0zy4=; Max-Age=7776000; Expires=Mon, 04 Jan 2021 15:48:46 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=17515234874874901785; Max-Age=7776000; Expires=Mon, 04 Jan 2021 15:48:46 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Tue, 06 Oct 2020 15:48:46 GMT
content-length: 0
set-cookie: tluid=17515234874874901785; Max-Age=7776000; Expires=Mon, 04 Jan 2021 15:48:46 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

pd
eu-u.openx.net/w/1.0/ Frame C6D4
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0

0
0

108ms
91ms

Document
text/html

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326; Version=1; Expires=Wed, 06-Oct-2021 15:48:46 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1601999326|gekin0vNiygu; Version=1; Expires=Wed, 21-Oct-2020 15:48:46 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 06 Oct 2020 15:48:46 GMT
content-type: text/html
content-length: 417
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326; Version=1; Expires=Wed, 06-Oct-2021 15:48:46 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
date: Tue, 06 Oct 2020 15:48:46 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2 200 sync.html
public.servenobid.com/ Frame 076A 0
0 39ms
10ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Thu, 01 Oct 2020 19:36:16 GMT
accept-ranges: bytes
etag: "1d8acc37f90e79d8d8f6f9960cb603b0"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: AVIOxSSjtL43K7dBRAnVEQ9DqX1aTYYaYJspIs0eiHX6cQiuH8pUQ8QBloebKsKgmoLCztARVGc=
x-amz-request-id: 8YDSFG2KBR0R1RDR
x-azure-ref-originshield: 0MHV7XwAAAACHzNxCKy4xTLFugn1O3rn+TE9OMjFFREdFMTUwOAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 03pF8XwAAAACeIMbiMc7rRbOreiA1A3iGRlJBRURHRTEwMjEAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date: Tue, 06 Oct 2020 15:48:46 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 276D 0
0 207ms
84ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=84769
Expires: Wed, 07 Oct 2020 15:21:35 GMT
Date: Tue, 06 Oct 2020 15:48:46 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 2F3E 0
0 201ms
81ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 06 Oct 2020 15:48:46 GMT
Age: 34969
X-Served-By: cache-lga21959-LGA, cache-hhn4065-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 369274
X-Timer: S1601999327.701982,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 9BEF 0
0 195ms
80ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 06 Oct 2020 15:48:46 GMT
Content-Length: 1136
Connection: keep-alive

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=pubmatic&uid=34CDD6CF-8C4A-47C6-9F6E-F953F2B9086F

0
198 B

180ms
174ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=pubmatic&uid=34CDD6CF-8C4A-47C6-9F6E-F953F2B9086F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-218-250.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:47 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Location: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=pubmatic&uid=34CDD6CF-8C4A-47C6-9F6E-F953F2B9086F
Date: Tue, 06 Oct 2020 15:48:46 GMT
X-Cnection: close
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 460
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
265 B 216ms
87ms Image
image/gif 52.17.171.52
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.171.52 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-171-52.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=sovrn&uid=b9972371ec247b87d9729be6

0
193 B

134ms
117ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=sovrn&uid=b9972371ec247b87d9729be6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-218-250.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:46 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Date: Tue, 06 Oct 2020 15:48:46 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=sovrn&uid=b9972371ec247b87d9729be6
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=TY2rG0Ha-B1V0_1LS42xShrS-RpV2f8ZHdo3A0pm

0
124 B

393ms
170ms

Image
text/plain

52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=TY2rG0Ha-B1V0_1LS42xShrS-RpV2f8ZHdo3A0pm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:46 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=TY2rG0Ha-B1V0_1LS42xShrS-RpV2f8ZHdo3A0pm
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 218ms
93ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A6962b8f0-07eb-11eb-9ff2-12a8bb4804a8&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
188 B 199ms
72ms Image
text/plain 37.157.6.242
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.242 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2

204

sync
pixel.advertising.com/ups/55946/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE2OTYyYjhmMC0wN2ViLTExZWItOWZmMi0xMmE4YmI0ODA0YTg%3D&gdpr=1&gdpr_consent=&_origin=0
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm=&google_hm=MUE2OTYyYjhmMC0wN2ViLTExZWItOWZmMi0xMmE4YmI0ODA0YTg%3D&gdpr=1&gdpr_consent=&_origin=0&google_tc=
https://pixel.advertising.com/ups/55946/sync?uid=CAESEGMZlYU0ydqAKc3HSXZ_4d4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

0
124 B

184ms
179ms

Image
text/plain

52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55946/sync?uid=CAESEGMZlYU0ydqAKc3HSXZ_4d4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:47 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:46 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.advertising.com/ups/55946/sync?uid=CAESEGMZlYU0ydqAKc3HSXZ_4d4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253Debed86fe-1756-4407-90fa-dd9ae626a43b%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=appnexus&uid=5320560874087046352

0
193 B

267ms
266ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=appnexus&uid=5320560874087046352
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-218-250.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:46 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:46 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.48:80
AN-X-Request-Uuid: f7e419a9-7ee1-443b-8d99-043706c7312e
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=appnexus&uid=5320560874087046352
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
125 B 402ms
168ms Image
text/plain 52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:46 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Debed86fe-1756-4407-90fa-dd9ae626a43b%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1
https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=index_rtb&uid=X3yR4LlQJLcAAGYPPcEAAABH%26209

0
193 B

117ms
117ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=index_rtb&uid=X3yR4LlQJLcAAGYPPcEAAABH%26209
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-24-218-250.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:48 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Tue, 06 Oct 2020 15:48:48 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://prebid.a-mo.net/setuid?A=ebed86fe-1756-4407-90fa-dd9ae626a43b&D=&bidder=index_rtb&uid=X3yR4LlQJLcAAGYPPcEAAABH%26209
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 320
Expires: Tue, 06 Oct 2020 15:48:48 GMT

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 5486 0
0 191ms
104ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326; pd=v2|1601999326|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326; Version=1; Expires=Wed, 06-Oct-2021 15:48:47 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1601999326.1|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Wed, 21-Oct-2020 15:48:47 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 06 Oct 2020 15:48:47 GMT
content-type: text/html
content-length: 315
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 5F98 0
0 100ms
96ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: uuid2=5320560874087046352
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 06 Oct 2020 15:48:47 GMT
Age: 34970
X-Served-By: cache-lga21959-LGA, cache-hhn4065-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 369278
X-Timer: S1601999327.078337,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 6D54 0
0 98ms
97ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=84768
Expires: Wed, 07 Oct 2020 15:21:35 GMT
Date: Tue, 06 Oct 2020 15:48:47 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame C9C5 0
0 196ms
81ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: uuid2=5320560874087046352
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 06 Oct 2020 15:48:47 GMT
Age: 34970
X-Served-By: cache-lga21959-LGA, cache-hhn4036-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 368045
X-Timer: S1601999327.196874,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame F231 0
0 91ms
89ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 06 Oct 2020 15:48:47 GMT
Content-Length: 1136
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame E1BA 0
0 191ms
80ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=84768
Expires: Wed, 07 Oct 2020 15:21:35 GMT
Date: Tue, 06 Oct 2020 15:48:47 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 6284 0
0 187ms
81ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 06 Oct 2020 15:48:47 GMT
Content-Length: 1136
Connection: keep-alive

GET
H2 200 pd
u.openx.net/w/1.0/ Frame F7FB 0
0 87ms
86ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.194.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326; pd=v2|1601999326.1|kiiygevNgun0.mWgqsLommOns
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=2cb1e3b8-fc3c-0b1a-157f-164157eea892|1601999326; Version=1; Expires=Wed, 06-Oct-2021 15:48:47 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1601999326.1|kiiygevNgun0.j8mWfcsHqGgqsLiSommOnsgi; Version=1; Expires=Wed, 21-Oct-2020 15:48:47 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.194.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 06 Oct 2020 15:48:47 GMT
content-type: text/html
content-length: 411
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame D8FD 43 B
565 B 286ms
75ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 06 Oct 2020 15:48:47 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame D8FD
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1

0
124 B

103ms
97ms

Image
text/plain

52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 06 Oct 2020 15:48:47 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Tue, 06 Oct 2020 15:48:47 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2ef42003-6cb7-469a-9ce2-8aad2e6d50b1
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame D8FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1
https://pixel.advertising.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184

0
963 B

1580ms
103ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 06 Oct 2020 15:48:48 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Tue, 06 Oct 2020 15:48:47 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFd3JUNQsMAin7KMX7nS4zk&google_cver=1&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55986/ Frame D8FD
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X3yR3wAAAJwWnDrr&_origin=0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X3yR3wAAAJwWnDrr&_origin=0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184

0
963 B

1585ms
98ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55986/sync?uid=X3yR3wAAAJwWnDrr&_origin=0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 06 Oct 2020 15:48:49 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Tue, 06 Oct 2020 15:48:47 GMT
location: https://ups.analytics.yahoo.com/ups/55986/sync?uid=X3yR3wAAAJwWnDrr&_origin=0&gdpr=0&gdpr_consent=&_test=X3yR3wAAAJwWnDrr&apid=UP6bd51ecc-07eb-11eb-983e-061fbcdb3184
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 120ms
120ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:48 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame D8FD 0
323 B 118ms
117ms XHR
multipart/form-data 18.218.150.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=64351
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.150.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-150-139.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 06 Oct 2020 15:48:50 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: as-sec.casalemedia.com
URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%229f6578023d0979%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2210dcc2df5558eb3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fucsf-pays-1-14m-after-netwalker-ransomware-attack%2F157015%2F%3Fmkt_tok%3DeyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1&nf=1

Verdicts & Comments Add Verdict or Comment

266 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			threatpost.com/	1970-01-29 12:58:32	Name: usprivacy Value: 1---
			.threatpost.com/	1970-01-19 22:21:35	Name: __gads Value: ID=a203e9e09878ee7b-228f2ce4efb80092:T=1601999323:S=ALNI_Ma_H5D3sF_w2QzsA5tHgGDo86b63g

48 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Startup v238
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: uspapi_init() - v0.105
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: USP: Locale=en-us gdpr= false
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	warning	URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: geo IP found region North Denmark
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: USP does not apply to North Denmark
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: Setting not applicable signal
console-api	info	URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2009282107000 https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
console-api	info	URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2009282107000 https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9
console-api	info	URL: https://cdn.ampproject.org/rtv/012009282107000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2009282107000 https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/?mkt_tok=eyJpIjoiWmpZM09XRTJaVGt4TkRjMyIsInQiOiJHSVF5bUxDQkxORXhyT2dSVmpiMEcrRUtNOTdkcjF5QmJGRmFkODhOWkdIOVdXc3NhSEFReGxkNVhicmV4b1ZYdDlqSnpBV3hCK0RUbGtFVVV3S1NxZm1tc3VkZDhoMmtlVTdKODdtRUdzM1Nxa1lYamFBQVUyUjF6MGZVN01JbyJ9

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1e153fedc91d27392c0434ac3ad9ded0.safeframe.googlesyndication.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cm.g.doubleclick.net
content.cloudflare.com
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.ipify.org
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
i0.wp.com
ib.adnxs.com
image2.pubmatic.com
img.connatix.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.gravatar.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
as-sec.casalemedia.com
100.24.218.250
104.111.215.135
104.111.230.142
104.17.74.206
104.244.42.131
104.244.42.133
151.101.113.108
151.101.114.49
151.101.12.157
151.101.194.137
165.227.252.242
167.172.1.14
172.217.23.130
18.197.185.70
18.218.150.139
185.64.189.112
185.64.190.80
192.0.77.2
199.232.53.140
205.185.216.10
216.52.2.19
216.58.206.2
23.210.249.164
23.210.249.92
2600:9000:203c:be00:6:44e3:f8c0:93a1
2600:9000:206e:3000:0:5c46:4f40:93a1
2600:9000:2156:600:2:9275:3d40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e0::ac40:6926
2620:116:800d:21:f916:5049:f87f:108e
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:806::2003
2a00:1450:4001:808::2002
2a00:1450:4001:815::2003
2a00:1450:4001:816::2008
2a00:1450:4001:81b::2001
2a00:1450:4001:81c::2004
2a00:1450:4001:81c::200a
2a00:1450:4001:81f::2001
2a00:1450:4001:81f::2002
2a00:1450:4001:820::200e
2a00:1450:4001:824::2001
2a00:1450:4001:824::2003
2a00:1450:400c:c06::9c
2a02:fa8:8806:16::1400
2a03:2880:f01c:800e:face:b00c:0:2
2a04:fa87:fffe::c000:4902
3.126.56.137
35.158.206.167
35.159.48.82
35.173.160.135
35.244.159.8
37.157.6.242
37.252.173.22
52.17.171.52
52.212.5.193
52.28.239.147
52.84.112.89
52.84.113.143
64.140.160.2
69.173.144.143
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
01c3a4ce829c1fbf0971eb258b96314724a64d2c5e50b8c088f60328c4f35df1
039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
072ab2e24f8ac0a6f43c0c0214b33e72c1f80b4cdea9503a416483a3d4cee21f
093ee8573c58af3b9ac0f59c675cd706101f7a5d67bf30d91d9ae67b8f66933e
09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee
0afbc9e34f7f853e49942248d59c7feff815e9fa3b5235beb23f4f5f340c4a2b
0b53158fac1f17ebd5a4939bd127529b81b44c261bbf65506b151ccae4071617
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0d12fa14ecd6446d9792031fb86a9b423611cf94c208d028a391a56f985919fd
1436c906c0691c6d7e77c015f3f454e1c3df917404c2b96171d5e7e899aa3c84
15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
177d14d07026c975817a777e98924ad8956b20cce801ea930e95e881a7d1d19c
185d5ff3cb0b3a389078f0bef7eb09cbb75c7e50a4047dceb2339424ba239429
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
239733db63c823ff0f27720321732ff16ae6591fd0a41b6793ee665e9226b42f
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
291b311ae3d3d4b7c42f0121588e0d8f35875044fd02318337f590b056b99db6
29257e6f0eaa20a411d881c29d9fdd181a811ec32b5fdd1cb46ec4bd4719861f
297d8459f553cfcd439bab0536308f3b323e87b7eb9af03089480ec7d297d303
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2f187ea1191232ace81e142232f03c6492c64d6c7e94e08756f311f2b8e34def
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
317b4a661a4243be85ae462fc23a937bea4e7176d6a1ac64a6c4f3b2c66296b5
31bef33672e71e0ebe8cac503763880c632c55bc4e0c3c8a37b0d9bc1d4e3957
33901d23b88c104fc2e9d2d029542d2c89eb30dff24f698f339a175d3a4267fa
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
351abe188a4ddd1117db403ebb5ec68dd848b9abee1838461c0d1bb498284ed2
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36fb36dd285ade6c5196d3c7edd6fa9b9ea5f61e8bb2c411fa67eb19776d7a6f
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3a90c56bbc2ea3fae7e089cc529bc02869c5035ee31c3111d829b9ae974cf42d
3ae2cde51f29a107125075bf92c00e55c5445102facff74bfb9488f894ae4088
3bf5e5a5381944084f99c7a3bb3e2dd4771902f6aa5cbc412f412c4711fc80f7
3c048a2d946f5162740622113b001ac16c4667d801eb79b1d834d1e499fbaac3
3ff5a0d6e55f27a1113753d45ae39862390111fd36fbb5a7f2f8d30345dd027d
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
422d3eed9bd2167f14ee53971dc5740481c118a1025c2eb1ed79f19fbe818ac0
43df5a24b9cc90d88dda35ce04b6683b0311b269107e2dedc4640e463096f355
459bfb9a61d6a0b1781cb35d0bbff8f32ea843b1e5321efa191d8d9cb752ed93
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4679b77bc0b273162881f1fb2fdd721cba182d7b554e56ab962f27745f34b542
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
5488e1362c5f2866a8717cca736567b68c675828dea25167f60dbe26661b3cc6
5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5e572014205666d38eb6c0cd51f9f85f5082dfd28ffdd3a31c1dda9aff598180
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
659afc50823467425ca7e8768f28a392a6ddcd93fe947e7dd32909cf83f3907c
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
76381863ace8c482168ffc2b29df3214a64f0a950fbb4bbf1e70c94b71b7967b
791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
82f60467c442f1292050ac1673c3074047283bfd9ff9be7480a65fddf6a24969
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
87adcd951526f566dd8a1eb655a8c4736a3bad8167f6e09a255e54650aeeb655
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
93ee1cf33c2f89ea4b40725a3fa6e12ef339841146b9725bab9d7607afd25f39
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08
9ef0cc99ae155124895f712a9b68285f7b0a8c3f3c151e86107a25b61cf22085
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2d2e8d6b81044d75a6188598772ff45d31a562b5c737b981248aec49ec66ec8
a9437bf0e59fa79766e66a8798c50c21040ffdad20e43687739a8847193c2684
a9ad536e6c2dbac817e0d88268a5dfa9d80263b80b1d4265681b82aad31c641e
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
af74766d929dc9aa19ea0fba57bdd5ba0a7aa5f24d3d2021b4d51bba179fcb6c
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
b522411ab157c6297f7523bb36c55fbb17f8e2bce8ab3fd5bd66a828186e5837
bf8daa3513ab91f20f94b51c085a6c0f33eb40311def4870c989b6c921c30da2
c49f918947601b5ebdf5957d404b920f294237ca8e0162d4086e549f6e28d401
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
c6879bf69ca14159cb61c4420c496946a303da8a9a37f6e0b4f4e12e79cbbf06
ca3492ecebc6ab3f883af4f90875b6fbb76fc19660f34ca64f1e5c41f4d7c60c
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d00e1ffbde89afc301abf43ed68bc52d7d7bae9f81d0bd93638394f4e287b12f
d199e44b7ac1627b528510813cbfd7666c63a74f4651ee3e0e625960812e1baf
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3
dbb71a92751d38f157fd81767ae5b6e6536d8c9dcd690a52036ed76554fc6da6
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e065984f0b5379a6b11ab4dc497fe57f7b56efd8326952d59ae1d57566e9fe4e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e63418cf65f537931557747222a416409d17a0df2baaa6bf87891da0514cff20
e802303cf96f81f08770093330e48df04ac2a0a9776dabaadaa0c308dae9320c
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f34e56bbdec33105361cc35f3805704b6d3df415b0bf044ef2a6f11764bd8a20
f45068d9955109994e74e581521de618f9f6aea2414383c1aa8096eabc780ee4
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fe5bdb0c294ee9456263dfaa69649f568247737ca178293545a72a75cb586f8b

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

236 Requests

98 %HTTPS

40 %IPv6

46 Domains

75 Subdomains

59 IPs

9 Countries

3805 kBTransfer

8263 kBSize

2 Cookies

16 Outgoing links

Page URL History

Redirected requests

236 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

236
Requests

98 %
HTTPS

40 %
IPv6

46
Domains

75
Subdomains

59
IPs

9
Countries

3805 kB
Transfer

8263 kB
Size

2
Cookies

236 HTTP transactions
0 data transactions