doublepulsar.com Open in urlscan Pro
52.1.119.170 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551...
Effective URL:
https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551...
Submission: On March 25 via automatic, source hackernews (March 25th 2019, 11:04:38 am UTC)

Summary HTTP 86 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 18 IPs in 2 countries across 11 domains to perform 86 HTTP transactions. The main IP is 52.1.119.170, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is doublepulsar.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 20th 2019. Valid for: a year.

This is the only time doublepulsar.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	52.1.119.170 52.1.119.170	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 6	2606:4700::68... 2606:4700::6810:787f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
17	2606:4700::68... 2606:4700::6810:7791	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
14	2606:4700::68... 2606:4700::6810:7591	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	104.16.90.50 104.16.90.50	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	13.35.254.99 13.35.254.99	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	35.153.236.75 35.153.236.75	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	13.35.253.62 13.35.253.62	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
9	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
5	2606:4700::68... 2606:4700::6810:7a7f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2600:9000:200... 2600:9000:200d:1a00:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
10	18.204.136.127 18.204.136.127	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 2	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER - Twitter Inc.)
2	2606:2800:134... 2606:2800:134:1a0d:1429:742:782:b6	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
4	2600:9000:200... 2600:9000:200d:3e00:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
86	18

6 52.1.119.170 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-1-119-170.compute-1.amazonaws.com

doublepulsar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:787f (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700::6810:7791 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-static-1.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-images-1.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700::6810:7591 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn-images-1.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.16.90.50 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

i.embed.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.254.99 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-254-99.fra6.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.153.236.75 (Seattle, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-153-236-75.compute-1.amazonaws.com

srv-2019-03-25-11.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.62 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-253-62.fra6.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:7a7f (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:200d:1a00:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 18.204.136.127 (Cambridge, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-204-136-127.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.72 (San Francisco, United States) 1 redirects

ASN13414 (TWITTER - Twitter Inc., US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:134:1a0d:1429:742:782:b6 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:200d:3e00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

abs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	medium.com 1 redirects medium.com glyph.medium.com cdn-static-1.medium.com cdn-images-1.medium.com	1 MB
11	twitter.com 1 redirects platform.twitter.com syndication.twitter.com	110 KB
10	lightstep.com collector-medium.lightstep.com	2 KB
6	doublepulsar.com 1 redirects doublepulsar.com	51 KB
5	branch.io cdn.branch.io api2.branch.io	23 KB
4	embed.ly i.embed.ly	8 KB
3	twimg.com cdn.syndication.twimg.com abs.twimg.com pbs.twimg.com	6 KB
2	parsely.com srv-2019-03-25-11.pixel.parsely.com	765 B
2	google-analytics.com www.google-analytics.com	18 KB
1	app.link app.link	701 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	16 KB
86	11

	Domain	Requested by
20	cdn-images-1.medium.com	doublepulsar.com
11	medium.com	1 redirects cdn-static-1.medium.com doublepulsar.com
10	collector-medium.lightstep.com	cdn-static-1.medium.com
9	platform.twitter.com	doublepulsar.com platform.twitter.com
7	glyph.medium.com	doublepulsar.com
6	doublepulsar.com	1 redirects doublepulsar.com cdn-static-1.medium.com
4	api2.branch.io	cdn.branch.io
4	i.embed.ly	doublepulsar.com
4	cdn-static-1.medium.com	doublepulsar.com cdn-static-1.medium.com
2	syndication.twitter.com	1 redirects doublepulsar.com
2	srv-2019-03-25-11.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
2	www.google-analytics.com	doublepulsar.com
1	pbs.twimg.com
1	abs.twimg.com
1	cdn.syndication.twimg.com	platform.twitter.com
1	app.link	cdn.branch.io
1	cdn.branch.io	doublepulsar.com
1	d1z2jf7jlzjs58.cloudfront.net	doublepulsar.com
86	18

This site contains links to these domains. Also see Links.

Domain
medium.com
technet.microsoft.com
posts.specterops.io

Subject Issuer	Validity	Valid
doublepulsar.com Sectigo RSA Domain Validation Secure Server CA	`2019-03-20` - `2020-03-19`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh
*.embed.ly COMODO RSA Domain Validation Secure Server CA	`2018-02-23` - `2021-02-22`	3 years	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2018-10-08` - `2019-10-09`	a year	crt.sh
*.pixel.parsely.com Amazon	`2019-02-27` - `2020-03-27`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2018-11-19` - `2019-11-27`	a year	crt.sh
medium.com DigiCert SHA2 Extended Validation Server CA	`2017-06-01` - `2019-08-30`	2 years	crt.sh
appipv4.link Amazon	`2018-09-17` - `2019-10-17`	a year	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-02-21` - `2019-05-22`	3 months	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2018-07-19` - `2019-08-28`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Frame ID: 932FD6BC89EE2CCE556AEBA4896884DB
Requests: 73 HTTP requests in this frame

Frame: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
Frame ID: EA24411DAB5F20C579D580FA9ED88717
Requests: 4 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2e9f365dae390394eb8d923cba8c5b11.html?origin=https%3A%2F%2Fdoublepulsar.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Frame ID: 4C0B817DC3305B1D3ECB277DCD02CD04
Requests: 1 HTTP requests in this frame

Frame: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
Frame ID: 4B27F808ECAFA4EAFA7E99A220C18138
Requests: 7 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2e9f365dae390394eb8d923cba8c5b11.html?origin=https%3A%2F%2Fdoublepulsar.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Frame ID: F9C4425395E31F4272BDC22B5039CC0A
Requests: 1 HTTP requests in this frame

Frame: https://abs.twimg.com/emoji/v2/72x72/1f9dd-1f3fd-200d-2640-fe0f.png
Frame ID: 61E8C8C394E38DD4436682F04B8D60C9
Requests: 9 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 6C3D4ECBE6FBD39C010316E0A22D5875
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-... HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergog... HTTP 302
https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-... Page URL

Detected technologies

Medium (Blogs) Expand

Overall confidence: 100%
Detected patterns

script /medium\.com/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Parse.ly (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^PARSELY$/i

Page Statistics

86
Requests

98 %
HTTPS

59 %
IPv6

11
Domains

18
Subdomains

18
IPs

2
Countries

1351 kB
Transfer

3664 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/policy/f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://medium.com/
Title: Homepage

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?redirect=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880&source=--------------------------nav_reg&operation=login
Title: Sign in

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/mt227395.aspx
Title: Local Administrator Password Solution

Search URL Search Domain Scan URL

URL: https://medium.com/p/c666551f5880/share/twitter

Search URL Search Domain Scan URL

URL: https://medium.com/p/c666551f5880/share/facebook

Search URL Search Domain Scan URL

URL: https://posts.specterops.io/putting-sysmon-v9-0-and-or-grouping-logic-to-the-test-c3ec27263df8?source=placement_card_footer_grid---------1-60

Search URL Search Domain Scan URL

URL: https://posts.specterops.io/@Cyb3rWard0g

Search URL Search Domain Scan URL

URL: https://posts.specterops.io/@Cyb3rWard0g?source=placement_card_footer_grid---------1-60
Title: Roberto Rodriguez

Search URL Search Domain Scan URL

URL: https://medium.com/iron-bastion/email-impersonation-scams-phishing-what-your-staff-can-do-6d0c12661143?source=placement_card_footer_grid---------2-60

Search URL Search Domain Scan URL

URL: https://medium.com/@gszathmari

Search URL Search Domain Scan URL

URL: https://medium.com/@gszathmari?source=placement_card_footer_grid---------2-60
Title: Gabor Szathmari

Search URL Search Domain Scan URL

URL: https://medium.com/@Medium/personalize-your-medium-experience-with-users-publications-tags-26a41ab1ee0c#.hx4zuv3mg
Title: Learn more

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880 HTTP 302
https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

86 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880 Show response
doublepulsar.com/
Redirect Chain

https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

173 KB
44 KB

369ms
369ms

Document
text/html

52.1.119.170
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.119.170 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-1-119-170.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

396e55a2b5b01136ae516c883ff9dea7faecea8d58f6e91d6c0bbdd420c813c8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://doublepulsar.com https://.doublepulsar.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: doublepulsar.com
:scheme: https
:path: /how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 25 Mar 2019 11:04:21 GMT
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://doublepulsar.com https://*.doublepulsar.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1553511861778:4a2a4b86141c
x-obvious-info: 36997-a1784da,a1784da5ffa
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
set-cookie: uid=lo_IOATP3YNvR4e; path=/; expires=Tue, 24 Mar 2020 11:04:21 GMT; secure; httponly sid=1:gUQoO0TcXZiJqtUZtO5lTrIEZ11ETvBZNQltHo8UMsLRDa9qI6Hzl00vGf36iEDq; path=/; expires=Tue, 24 Mar 2020 11:04:21 GMT; secure; httponly
tk: T
content-encoding: gzip

Redirect headers

status: 302
date: Mon, 25 Mar 2019 11:04:21 GMT
content-type: application/octet-stream
set-cookie: __cfduid=d2e9dfee01f12be249691ff953f6bd72e1553511861; expires=Tue, 24-Mar-20 11:04:21 GMT; path=/; domain=.medium.com; HttpOnly uid=lo_IOATP3YNvR4e; Expires=Tue, 24-Mar-20 11:04:21 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly sid=1:8PnVrmxgU1H7MFxhRZHTe5srIuJ9fviBR4CY547daDQT6AkKKUApa0TcIlp4Tdvo; path=/; expires=Tue, 24 Mar 2020 11:04:21 GMT; domain=.medium.com; secure; httponly
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com:443 https://*.medium.com:443 https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1553511861638:858eeee11860
x-obvious-info: 36997-a1784da,a1784da5ffa
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
tk: T
location: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
strict-transport-security: max-age=15552000; includeSubDomains; preload
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4bd0674ed97d63d9-FRA

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 64ms
20ms Stylesheet
text/css 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 4bd067526839c283-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Mon, 25 Mar 2019 15:04:22 GMT

GET
H2 200 main-branding-base.h0SGv1w1YKQgi84KqVJ5cw.css
cdn-static-1.medium.com/_/fp/css/ 509 KB
64 KB 67ms
16ms Stylesheet
text/css 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-static-1.medium.com/_/fp/css/main-branding-base.h0SGv1w1YKQgi84KqVJ5cw.css

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5fce34cf8275fb2efbcf70a61073863d0cc68053ad34e13aadc46d9f0a33392

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-request-id: 793F9B4B3A1B13AF
status: 200
vary: Accept-Encoding
content-length: 65425
x-amz-id-2: ZsNZ7mXWZPl2f0fVivo/ON22xwEnf+6h4F6d6n7bPpeCmTmbOUb2GJZa7z2Y0CMUwSB4cpmqymU=
last-modified: Fri, 22 Mar 2019 15:53:37 GMT
server: cloudflare
etag: "43de4bb3f1a268ce710787552e1638a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 4bd06752786ec283-FRA
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:824::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 4646
date: Mon, 25 Mar 2019 09:46:56 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Mon, 25 Mar 2019 11:46:56 GMT

GET
H2 200 1*bry5HIDtIpONm_IDzSVYWA.jpeg
cdn-images-1.medium.com/letterbox/164/72/50/50/ 6 KB
6 KB 205ms
156ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/letterbox/164/72/50/50/1*bry5HIDtIpONm_IDzSVYWA.jpeg?source=logoAvatar-lo_IOATP3YNvR4e---8343faddf0ec

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

ecd4e7d93b0e021e5aa40a1589b5aa70dba23d80f9cb9020998bd3ead915226d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 5693
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd067526866c283-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
cdn-images-1.medium.com/fit/c/100/100/ 5 KB
5 KB 64ms
19ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/100/100/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

8222827f30af9fde51d3606dc61f0adec462f14a7128c48bf45052fa4aaaf4da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3186-c68af25
status: 200
vary: Accept-Encoding
content-length: 5319
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd067527881c283-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*SOHRtJVPbpRSX-9mO7Vrlw.png
cdn-images-1.medium.com/freeze/max/60/ 3 KB
3 KB 65ms
24ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*SOHRtJVPbpRSX-9mO7Vrlw.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d2b15b586d9bef47b35288575d6a7d7b37ddd2ea931a76f4ede918d15c7067b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 2934
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06752e8e56355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 resize
i.embed.ly/1/display/ 2 KB
3 KB 63ms
12ms Image
image/jpeg 104.16.90.50
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.embed.ly/1/display/resize?url=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FD2Czg32XQAEagSn.jpg%3Alarge&key=a19fcc184b9711e1b4764040d3dc5c07&width=40
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.90.50 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d9939299f78f1ae25a7b133ed5f9ba06c00af6ccf0fb8a9a94f74f23f29efff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
cf-cache-status: HIT
last-modified: Tue, 19 Mar 2019 19:06:41 GMT
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
access-control-expose-headers: content-range,content-length,accept-ranges
cache-control: public, max-age=43200
access-control-allow-credentials: *
cf-ray: 4bd06752fa782756-FRA
access-control-allow-headers: range
expires: Mon, 25 Mar 2019 23:04:22 GMT

GET
H2 200 resize
i.embed.ly/1/display/ 1 KB
2 KB 64ms
13ms Image
image/jpeg 104.16.90.50
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.embed.ly/1/display/resize?url=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FD2Dah4oWkAACyU5.jpg%3Alarge&key=a19fcc184b9711e1b4764040d3dc5c07&width=40
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.90.50 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e59708a37ef1a3e666ca1fb98528e3fde7e2a4628a1fd7e795a0a98b8759329

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
cf-cache-status: HIT
last-modified: Tue, 19 Mar 2019 21:57:09 GMT
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
access-control-expose-headers: content-range,content-length,accept-ranges
cache-control: public, max-age=43200
access-control-allow-credentials: *
cf-ray: 4bd06752fa7a2756-FRA
access-control-allow-headers: range
expires: Mon, 25 Mar 2019 23:04:22 GMT

GET
H2 200 resize
i.embed.ly/1/display/ 2 KB
2 KB 63ms
13ms Image
image/jpeg 104.16.90.50
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.embed.ly/1/display/resize?url=https%3A%2F%2Fpbs.twimg.com%2Fprofile_images%2F1044953724924366851%2FMgA_DmwC_400x400.jpg&key=a19fcc184b9711e1b4764040d3dc5c07&width=40
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.90.50 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54b58bff818df7ac7c2785286dc32585b101d19ebec193fdb7da0e76dbf97e73

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
cf-cache-status: HIT
last-modified: Wed, 26 Sep 2018 14:13:56 GMT
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
access-control-expose-headers: content-range,content-length,accept-ranges
cache-control: public, max-age=43200
access-control-allow-credentials: *
cf-ray: 4bd06752fa792756-FRA
access-control-allow-headers: range
expires: Mon, 25 Mar 2019 23:04:22 GMT

GET
H2 200 1*Hex7aXY4o-jbNvYCd2RLXw.png
cdn-images-1.medium.com/freeze/max/60/ 762 B
830 B 59ms
22ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*Hex7aXY4o-jbNvYCd2RLXw.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

01925fca42df9c862374a00188a2c240464740242e1c5f2ffd8735d8a4d72b27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 762
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06752e8e76355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*MLe7ZQgEqEXq2CK8KMLfDg.png
cdn-images-1.medium.com/freeze/max/60/ 4 KB
4 KB 61ms
24ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*MLe7ZQgEqEXq2CK8KMLfDg.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d81ad0278108873cc76f97aa61cbf62baeef7b3cca383d90aa1c31cfa1b1629f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 4180
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06752e8e86355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*Mgf6v7KK_4Ykptf8SqsH2A.png
cdn-images-1.medium.com/freeze/max/60/ 5 KB
5 KB 51ms
15ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*Mgf6v7KK_4Ykptf8SqsH2A.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e2e081ca0b071382f8aa06efe5cf9e599f0dc687fcb5f1cecba35e6686d1f663

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 4962
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06752e8e96355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 resize
i.embed.ly/1/display/ 2 KB
2 KB 62ms
13ms Image
image/jpeg 104.16.90.50
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.embed.ly/1/display/resize?url=https%3A%2F%2Fpbs.twimg.com%2Fprofile_images%2F1090532352223297536%2FYxtzyIn-_400x400.jpg&key=a19fcc184b9711e1b4764040d3dc5c07&width=40
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.16.90.50 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffe536c89e72e825974d7180e35234e50aa14cec4870f59fad365e509fc7efde

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
cf-cache-status: HIT
last-modified: Wed, 30 Jan 2019 08:47:08 GMT
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
access-control-expose-headers: content-range,content-length,accept-ranges
cache-control: public, max-age=43200
access-control-allow-credentials: *
cf-ray: 4bd06752fa7b2756-FRA
access-control-allow-headers: range
expires: Mon, 25 Mar 2019 23:04:22 GMT

GET
H2 200 1*OZcgdhrpLw1pGzPxfH46nA.png
cdn-images-1.medium.com/freeze/max/60/ 2 KB
2 KB 54ms
18ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*OZcgdhrpLw1pGzPxfH46nA.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

f03c244c32a2fc980cfee708e0813bf36c60483e9f8ed9c0b657fcc1d15bc4e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 1567
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06752e8ea6355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*GUnyhGfWXE5KWcDy0drYuw.png
cdn-images-1.medium.com/freeze/max/60/ 4 KB
4 KB 28ms
26ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*GUnyhGfWXE5KWcDy0drYuw.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9cb742bdb7a3734e5ffba85c9acb9772e1b74e22bc3fa58fd3563ac31a8d467d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 4406
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06753090c6355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*A9yeBzYYaXHpqJoA5o8NWA.png
cdn-images-1.medium.com/freeze/max/60/ 2 KB
2 KB 19ms
18ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*A9yeBzYYaXHpqJoA5o8NWA.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

3c06e5f8a1bcaa33b3e54ebbb4908038d04da5c81b29c040c0ce09771b7b51ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 2197
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06753090d6355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*6asmb4-6wInaP4B5aEd3qQ.png
cdn-images-1.medium.com/freeze/max/60/ 6 KB
6 KB 22ms
21ms Image
image/png 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/freeze/max/60/1*6asmb4-6wInaP4B5aEd3qQ.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

6aa27d4543eb33a99a229f4312df8f8ed823ec3a6bd2b281e6afc784d0d5ff31

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 5755
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06753090e6355-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
cdn-images-1.medium.com/fit/c/120/120/ 6 KB
6 KB 24ms
23ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/120/120/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

dd288ea9c54b0fd8feedd3de8e2c91e77ca2fa58380945665ee83d54fc808aa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 6332
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd067530abdc283-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*euFkwA7zJWm-l7aDoNtJrw.jpeg
cdn-images-1.medium.com/fit/c/120/120/ 7 KB
7 KB 24ms
23ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/120/120/1*euFkwA7zJWm-l7aDoNtJrw.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

48b612477d7a718ad054a6c46be64c13f6610325ed1d8979db008b1c021ac8c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 7042
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd067530abec283-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 1*euFkwA7zJWm-l7aDoNtJrw.jpeg
cdn-images-1.medium.com/fit/c/80/80/ 3 KB
3 KB 17ms
16ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/80/80/1*euFkwA7zJWm-l7aDoNtJrw.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d49f9d5f6cf0fe5e246dae163447d21a876c54cdf3da502fca7d95f2441a51a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 3499
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd067530ac0c283-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H2 200 main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js Show response
cdn-static-1.medium.com/_/fp/gen-js/ 1 MB
339 KB 17ms
16ms Script
application/javascript 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

81e3ca1be527a50f43fd3e340df21379473a569bbbc87f8606d42951446f937f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-request-id: 87D9109F941F9E8E
status: 200
vary: Accept-Encoding
content-length: 346365
x-amz-id-2: zsaj3R8ekiciOFWXnyBYgmXYDo0hzSMhlIG1BYf/72I6zOOKuB0B8hGODPoznFw+niZOQ2GMvmA=
last-modified: Fri, 22 Mar 2019 19:39:18 GMT
server: cloudflare
etag: "74de50f89e1747d8d61f77f6599d6eee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 4bd067530ac1c283-FRA
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 stat
doublepulsar.com/_/ 43 B
1 KB 146ms
144ms Image
image/gif 52.1.119.170
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://doublepulsar.com/_/stat?event=pixel.load&origin=https%3A%2F%2Fdoublepulsar.com

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.119.170 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-1-119-170.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://doublepulsar.com https://.doublepulsar.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /_/stat?event=pixel.load&origin=https%3A%2F%2Fdoublepulsar.com
pragma: no-cache
cookie: uid=lo_IOATP3YNvR4e; sid=1:gUQoO0TcXZiJqtUZtO5lTrIEZ11ETvBZNQltHo8UMsLRDa9qI6Hzl00vGf36iEDq
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: doublepulsar.com
referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
:scheme: https
:method: GET
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 200
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1553511862245:ccf7d2c0912d
server: nginx
tk: T
x-frame-options: sameorigin
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://doublepulsar.com https://*.doublepulsar.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

GET
DATA 200
OK truncated
/ 9 KB
0 Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://doublepulsar.com

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
14 KB 59ms
21ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 4bd06752f8fc6355-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
DATA 200
OK truncated
/ 10 KB
0 Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://doublepulsar.com

Response headers

Content-Type: font/opentype

GET
H2 200 charter-400-italic.woff
glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
11 KB 52ms
14ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-400-italic.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 4bd06752f8fd6355-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
DATA 200
OK truncated
/ 10 KB
0 Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://doublepulsar.com

Response headers

Content-Type: font/opentype

GET
H2 200 marat-sans-300-italic.woff
glyph.medium.com/font/24e0824/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 55ms
18ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/24e0824/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/marat-sans-300-italic.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a548a3f01f6d92045be9ae44e89520ed11505928139d831749385a36aee74c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 4bd06752f8ff6355-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 charter-700-normal.woff
glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 50ms
20ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 4bd06752f9006355-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 fd7cfad97d16a40ae7e4f86274148cbf Show response
doublepulsar.com/media/ Frame EA24 2 KB
2 KB 157ms
157ms Document
text/html 52.1.119.170
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.119.170 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-1-119-170.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

ea9e51ae2db8e599770b1eb6f450fc9d6f7ac11da8acb638738fcb82d650bf4e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://doublepulsar.com https://.doublepulsar.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: doublepulsar.com
:scheme: https
:path: /media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
accept-encoding: gzip, deflate, br
cookie: uid=lo_IOATP3YNvR4e; sid=1:gUQoO0TcXZiJqtUZtO5lTrIEZ11ETvBZNQltHo8UMsLRDa9qI6Hzl00vGf36iEDq
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Response headers

status: 200
server: nginx
date: Mon, 25 Mar 2019 11:04:22 GMT
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://doublepulsar.com https://*.doublepulsar.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1553511862262:705ef6cd0a8a
x-obvious-info: 36997-a1784da,a1784da5ffa
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
tk: T
content-encoding: gzip

GET
DATA 200
OK truncated
/ 149 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1a9f0f2844d80ca5a41f2d483d56d674eb333e570706b935cf46add6aa2f31d

Request headers

Response headers

Content-Type: image/svg+xml

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
14 KB 19ms
19ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 4bd06753192a6355-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 charter-400-normal.woff
glyph.medium.com/font/be78681/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 19 KB
19 KB 27ms
27ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/be78681/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/charter-400-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc72a2ca45067a3d17fed4cd8776fec5dca3b9ecd7300e107f9256a86a0c8b2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 4bd0675359866355-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
121 B 15ms
14ms Image
image/gif 2a00:1450:4001:824::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1700749921&t=pageview&_s=1&dl=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880%3Fgi%3D4d2b90239266&ul=en-us&de=UTF-8&dt=How%20Lockergoga%20took%20down%20Hydro%E2%80%8A%E2%80%94%E2%80%8Aransomware%20used%20in%20targeted%20attacks%20aimed%20at%20big%20business&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=978306062&gjid=356550804&cid=127746780.1553511862&tid=UA-24232453-2&_gid=1375829289.1553511862&_r=1&z=1560607539

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
16 KB 55ms
7ms Script
application/x-javascript 13.35.254.99
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.254.99 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-35-254-99.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: b5e98b4bc41f421981af91804a14836e78816f30d3ba7ce7acf61debd666b53e

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: public
Date: Sun, 24 Mar 2019 20:26:26 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2019 20:16:50 GMT
Server: nginx
Age: 52707
ETag: W/"5c59ef32-a448"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
Connection: keep-alive
X-Amz-Cf-Id: LiRa2820t7iKCvEojGipxT_Mu4jntrzfVWbT9NOMsfHgw9nqC9Mf_Q==
Expires: Mon, 25 Mar 2019 20:25:52 GMT

GET
H/1.1 200
OK / Show response
srv-2019-03-25-11.pixel.parsely.com/start/ 77 B
380 B 488ms
104ms Script
application/json 35.153.236.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2019-03-25-11.pixel.parsely.com/start/?rand=1553511862498&plid=57854132&idsite=medium.com&url=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880%3Fgi%3D4d2b90239266&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880%3Fgi%3D4d2b90239266&sref=&sts=1553511862494&slts=0&title=How+Lockergoga+took+down+Hydro%E2%80%8A%E2%80%94%E2%80%8Aransomware+used+in+targeted+attacks+aimed+at+big+business&date=Mon+Mar+25+2019+11%3A04%3A22+GMT%2B0000+(Coordinated+Universal+Time)&action=pageview&pvid=16088001&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.236.75 Seattle, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-35-153-236-75.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 05e3a889ba8070cdb0233a70af8761b882ebb3c843ff5340a86a3dd15ecdb3e8

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:22 GMT
Server: nginx
Connection: keep-alive
Content-Type: application/json
Content-Length: 77
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 70 KB
21 KB 47ms
7ms Script
text/javascript 13.35.253.62
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.62 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-35-253-62.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a8ffdb922f0525a50cdc117bda012e2e5eb1f2281fe5189a0cb37499b1a446b

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id: B5UyDl4GX0TWbMj8h.f2a8s3ivBrePzX
Content-Encoding: gzip
Last-Modified: Wed, 30 Jan 2019 21:30:03 GMT
Server: AmazonS3
Age: 167
ETag: "14b6955c76f6dc3a7c6859e615f5124a"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 d5fb859c39a16d7f218b4c7fb1528ad6.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Mon, 25 Mar 2019 11:01:36 GMT
Connection: keep-alive
Content-Length: 21327
X-Amz-Cf-Id: _xscKEHEhcV3pkg--NgEG7Pds0Nno0VGWc6Mk2m32wVDTx7hniys1g==

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ Frame EA24 93 KB
28 KB 61ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A1) /
Resource Hash: 460c112ca18e517ef1a6c6abb2ba5ae55187138503a10177bf1908d9261c3a19

Request headers

Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:22 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Mar 2019 17:40:21 GMT
Server: ECS (fcn/41A1)
Etag: "4cf9f34505e9344b9a7e4d00e67b6c88+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 28028

GET
H/1.1 200
OK widget_iframe.2e9f365dae390394eb8d923cba8c5b11.html
platform.twitter.com/widgets/ Frame 4C0B 0
0 25ms
17ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2e9f365dae390394eb8d923cba8c5b11.html?origin=https%3A%2F%2Fdoublepulsar.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40DF) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Mar 2019 11:04:22 GMT
Etag: "347ce5de96d97a02c18244967b8b6532+gzip"
Last-Modified: Thu, 07 Mar 2019 17:39:26 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40DF)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5783

GET moment~timeline~tweet.6e5b62723488aee38af0c77681396a5b.js
platform.twitter.com/js/ Frame EA24 0
0

GET tweet.2b7769d244a8dfeb3ab9d97583412dec.js
platform.twitter.com/js/ Frame EA24 0
0

GET
H2 200 main-common-async.bundle.3A7GeuXInDHd8rVnpEzmJw.js Show response
cdn-static-1.medium.com/_/fp/gen-js/ 645 KB
176 KB 30ms
17ms Script
application/javascript 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-static-1.medium.com/_/fp/gen-js/main-common-async.bundle.3A7GeuXInDHd8rVnpEzmJw.js

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0e19a719a047db27e6d01dac74c3845f4e26ee27c15f0ae5cbc0ff78b6864e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-request-id: EBD68AEEDBE80A4B
status: 200
vary: Accept-Encoding
content-length: 179755
x-amz-id-2: 6OUgECBZ5E3ClqXz/yIkYfY+6Icd9ObVqvirzZdUi6G2Yks4B0kTjwUelSED++W+sJ0y3zoYKLs=
last-modified: Fri, 22 Mar 2019 19:39:18 GMT
server: cloudflare
etag: "5181ecd0249944c6643b39c2c75af5b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 4bd067563ed5c283-FRA
expires: Tue, 24 Mar 2020 11:04:22 GMT

GET
H2 200 fd7cfad97d16a40ae7e4f86274148cbf Show response
doublepulsar.com/media/ Frame 4B27 2 KB
2 KB 155ms
154ms Document
text/html 52.1.119.170
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.119.170 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-1-119-170.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

ea9e51ae2db8e599770b1eb6f450fc9d6f7ac11da8acb638738fcb82d650bf4e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://doublepulsar.com https://.doublepulsar.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: doublepulsar.com
:scheme: https
:path: /media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266
accept-encoding: gzip, deflate, br
cookie: uid=lo_IOATP3YNvR4e; sid=1:gUQoO0TcXZiJqtUZtO5lTrIEZ11ETvBZNQltHo8UMsLRDa9qI6Hzl00vGf36iEDq; _ga=GA1.2.127746780.1553511862; _gid=GA1.2.1375829289.1553511862; _gat=1; _parsely_session={%22sid%22:1%2C%22surl%22:%22https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266%22%2C%22sref%22:%22%22%2C%22sts%22:1553511862494%2C%22slts%22:0}; lightstep_guid/medium-web=807b5c3ca4104bf6; lightstep_session_id=3b8e6e3f8c357426
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880?gi=4d2b90239266

Response headers

status: 200
server: nginx
date: Mon, 25 Mar 2019 11:04:22 GMT
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://doublepulsar.com https://*.doublepulsar.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1553511862878:3d9b84d3d8ff
x-obvious-info: 36997-a1784da,a1784da5ffa
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
tk: T
content-encoding: gzip

OPTIONS
H2 204 upvotes Show response
medium.com/p/c666551f5880/ 0
2 KB 172ms
131ms XHR
text/plain 2606:4700::6810:7a7f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/p/c666551f5880/upvotes

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7a7f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://medium.com:443 https://.medium.com:443 https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Access-Control-Request-Method: GET
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,x-client-date,x-obvious-cid,x-opentracing,x-xsrf-token

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 204
access-control-max-age: 86400
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
access-control-allow-headers: Accept, Content-Type, Origin, User-Agent, DNT, Cache-Control, X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, x-opentracing
x-obvious-tid: 1553511863026:9bd7e23d9611
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://doublepulsar.com
cache-control: no-cache
access-control-allow-credentials: true
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com:443 https://*.medium.com:443 https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
cf-ray: 4bd067578ef396e2-FRA
link: <https://medium.com/humans.txt>; rel="humans"

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
701 B 226ms
157ms Script
text/javascript 2600:9000:200d:1a00:19:9934:6a80:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.49.0&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:200d:1a00:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

00ee87fc8aab7dcd28e2cf9771427b084359bba3fa5f1ef0b4c4a0c533d834df

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:23 GMT
Via: 1.1 96c175ce63da79b249fc4597809077cc.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-SbZ0SEd+uXVyggnbQkIVZUhFrnE"
X-Amz-Cf-Id: e_dPRoE6fFqrfNkByMBT7S2PdwsTG9rUsMNbX4tQFDfOZH9NMpBnXQ==

GET
H2 200 1*SOHRtJVPbpRSX-9mO7Vrlw.png
cdn-images-1.medium.com/max/1600/ 166 KB
166 KB 27ms
27ms Image
image/png 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/max/1600/1*SOHRtJVPbpRSX-9mO7Vrlw.png

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

8778929fff9f35ff06f7b818e30b2ce6bafc4518858b37f86580924e31196100

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:22 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 169757
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd067577b61c283-FRA
expires: Wed, 24 Apr 2019 11:04:22 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ Frame 4B27 93 KB
0 61ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A1) /
Resource Hash: 460c112ca18e517ef1a6c6abb2ba5ae55187138503a10177bf1908d9261c3a19

Request headers

Response headers

Date: Mon, 25 Mar 2019 11:04:22 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Mar 2019 17:40:21 GMT
Server: ECS (fcn/41A1)
Etag: "4cf9f34505e9344b9a7e4d00e67b6c88+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 28028

GET
H/1.1 200
OK widget_iframe.2e9f365dae390394eb8d923cba8c5b11.html
platform.twitter.com/widgets/ Frame F9C4 0
0 11ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2e9f365dae390394eb8d923cba8c5b11.html?origin=https%3A%2F%2Fdoublepulsar.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41AB) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Mar 2019 11:04:23 GMT
Etag: "347ce5de96d97a02c18244967b8b6532+gzip"
Last-Modified: Thu, 07 Mar 2019 17:39:26 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/41AB)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5783

GET
H/1.1 200
OK moment~timeline~tweet.6e5b62723488aee38af0c77681396a5b.js Show response
platform.twitter.com/js/ Frame 4B27 24 KB
8 KB 8ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.6e5b62723488aee38af0c77681396a5b.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4186) /
Resource Hash: e26fdccb214e020f70cf2aede7b77d5dc51854e23b3acbb4bcff0018773a636f

Request headers

Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:23 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Mar 2019 17:39:15 GMT
Server: ECS (fcn/4186)
Etag: "da3e8002f83d92efe615008a56f12f48+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7925

GET
H/1.1 200
OK tweet.2b7769d244a8dfeb3ab9d97583412dec.js Show response
platform.twitter.com/js/ Frame 4B27 18 KB
6 KB 10ms
9ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/tweet.2b7769d244a8dfeb3ab9d97583412dec.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40EA) /
Resource Hash: 9c6ea1ab4588c0be7dc9cb629aa641415dd91acaea7084de6921a7ffa2299bfb

Request headers

Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:23 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Mar 2019 17:39:15 GMT
Server: ECS (fcn/40EA)
Etag: "20fa27831d8703b8d33a11abad368f93+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 6038

GET
H2 200 main-notes.bundle.rD8hVOjp0dzdfkyiO-vf3g.js Show response
cdn-static-1.medium.com/_/fp/gen-js/ 89 KB
29 KB 24ms
24ms Script
application/javascript 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-static-1.medium.com/_/fp/gen-js/main-notes.bundle.rD8hVOjp0dzdfkyiO-vf3g.js

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f722324dc9170337b1ff06d47e34550df9c0a5e6bb8a6c3fc6f1387a43127320

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-request-id: E9178B67F0CB383C
status: 200
vary: Accept-Encoding
content-length: 29275
x-amz-id-2: J64nKoeVdQlo6GdCe8rPUet07v6jK+uGvKntw04enzv7HF0TV9l+KxQajpClyiP/g8EklfS0938=
last-modified: Fri, 22 Mar 2019 19:39:18 GMT
server: cloudflare
etag: "670ec9971a0d908a6d8e0bc89dd1c942"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 4bd067580d6bc283-FRA
expires: Tue, 24 Mar 2020 11:04:23 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 377ms
106ms XHR
text/plain 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 25 Mar 2019 11:04:23 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

GET
H2 200 syndication
syndication.twitter.com/i/jot/ Frame 4B27 43 B
120 B 128ms
127ms Image
image/gif 104.244.42.72
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?dnt=1&l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1553511863089%2C%22dnt%22%3Atrue%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 116
pragma: no-cache
last-modified: Mon, 25 Mar 2019 11:04:23 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 32acbd7e1c350bc32012979a994e0976
x-transaction: 006f292000fab286
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 upvotes Show response
medium.com/p/c666551f5880/ 9 KB
1 KB 158ms
157ms XHR
application/json 2606:4700::6810:787f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/p/c666551f5880/upvotes

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:787f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

5657eadb053d8a3a0aeabd467171a76e3a017dd22eae48c1ea3516c4b417ffa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

X-Client-Date: 1553511862919
Origin: https://doublepulsar.com
X-XSRF-Token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json
X-Obvious-CID: web
Accept: application/json
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
x-opentracing: {"ot-tracer-spanid":"1239802d83e67a","ot-tracer-traceid":"0b96627659328da9","ot-tracer-sampled":"true"}

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 200
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1553511863160:ca84b715f036
server: cloudflare
x-frame-options: sameorigin
tk: T
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://doublepulsar.com
access-control-expose-headers: X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, X-Obvious-Profiling, X-Diagnostics, x-opentracing
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 4bd067586b1b63d9-FRA
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

GET
H2 200 tweets.json Show response
cdn.syndication.twimg.com/ Frame 4B27 6 KB
2 KB 153ms
133ms Script
application/javascript 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/tweets.json?callback=__twttr.callbacks.cb0&ids=699865460553207808-t&lang=en&suppress_response_codes=true&theme=light&tz=GMT%2B0000

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

tsa_o /

Resource Hash

44704d3f11b7eea4bc6bdd815eb26c4ad55e13f2274fb0d338bba8274c43a50f

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-disposition: attachment; filename=jsonp.jsonp
strict-transport-security: max-age=631138519
content-length: 1676
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 121
last-modified: Mon, 25 Mar 2019 11:04:23 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=60
x-connection-hash: 960146b26ab7cf6c5898adf9f9971471
timing-allow-origin: *
x-transaction: 00ed8e050094d6ff
expires: Mon, 25 Mar 2019 11:05:23 GMT

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
581 B 518ms
469ms XHR
application/json 2600:9000:200d:3e00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:3e00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 399c7f76001ab13bfa085f0ebd942150a706b9bf02ba03c562ea5149de5734ca

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: pt9dZYFHS1YGXe07eNuXJjAT_iSMZR5ZhLrVAGq9rAIQYyGwndhrbA==

OPTIONS
H2 204 quotes Show response
medium.com/p/c666551f5880/ 0
244 B 159ms
158ms XHR
text/plain 2606:4700::6810:7a7f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/p/c666551f5880/quotes

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7a7f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://medium.com:443 https://.medium.com:443 https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Access-Control-Request-Method: GET
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,x-client-date,x-obvious-cid,x-xsrf-token

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 204
access-control-max-age: 86400
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
access-control-allow-headers: Accept, Content-Type, Origin, User-Agent, DNT, Cache-Control, X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, x-opentracing
x-obvious-tid: 1553511863248:1ad07bb76177
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://doublepulsar.com
cache-control: no-cache
access-control-allow-credentials: true
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com:443 https://*.medium.com:443 https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
cf-ray: 4bd06758e96596e2-FRA
link: <https://medium.com/humans.txt>; rel="humans"

OPTIONS
H2 204 responses Show response
medium.com/_/api/posts/c666551f5880/ 0
149 B 485ms
484ms XHR
text/plain 2606:4700::6810:7a7f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/_/api/posts/c666551f5880/responses?filter=best

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7a7f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://medium.com:443 https://.medium.com:443 https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Access-Control-Request-Method: GET
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,x-client-date,x-obvious-cid,x-opentracing,x-xsrf-token

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 204
access-control-max-age: 86400
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
access-control-allow-headers: Accept, Content-Type, Origin, User-Agent, DNT, Cache-Control, X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, x-opentracing
x-obvious-tid: 1553511863541:a8863e1301e2
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://doublepulsar.com
cache-control: no-cache
access-control-allow-credentials: true
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com:443 https://*.medium.com:443 https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
cf-ray: 4bd06758e97a96e2-FRA
link: <https://medium.com/humans.txt>; rel="humans"

GET
H2 200 1f9dd-1f3fd-200d-2640-fe0f.png
abs.twimg.com/emoji/v2/72x72/ Frame 61E8 1 KB
1 KB 10ms
8ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abs.twimg.com/emoji/v2/72x72/1f9dd-1f3fd-200d-2640-fe0f.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41D8) /

Resource Hash

06399f318b8adceecbbfcc8371aef8f7716609e5036f461019ad3e76d6d5a1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
x-content-type-options: nosniff
x-ton-expected-size: 1091
x-cache: HIT
status: 200
content-length: 1091
x-response-time: 130
surrogate-key: twitter-assets
last-modified: Wed, 21 Feb 2018 22:30:40 GMT
server: ECS (fcn/41D8)
etag: "KPlKq6OOEY2UNrqCx8poVQ=="
content-type: image/png
access-control-allow-origin: *
x-connection-hash: 73e57673c6ab742be199a9715d6147ac
accept-ranges: bytes
expires: Tue, 24 Mar 2020 11:04:23 GMT

GET
H/1.1 200
OK tweet.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
platform.twitter.com/css/ Frame 61E8 54 KB
13 KB 31ms
11ms Stylesheet
text/css 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/tweet.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A3) /
Resource Hash: c139b8dd7b1ccda2813ae79d127d1c0256f91a71fce5581887a1d5fbbca81bde

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:23 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Mar 2019 17:39:11 GMT
Server: ECS (fcn/41A3)
Etag: "ae6fef09ef216879adf6be6beb2522ea+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12323

GET
H/1.1 200
OK tweet.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
platform.twitter.com/css/ Frame 4B27 54 KB
54 KB 25ms
7ms Image
text/css 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/tweet.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A3) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://doublepulsar.com/media/fd7cfad97d16a40ae7e4f86274148cbf?postId=c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:23 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Mar 2019 17:39:11 GMT
Server: ECS (fcn/41A3)
Etag: "ae6fef09ef216879adf6be6beb2522ea+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12323

GET
H2 200 quotes Show response
medium.com/p/c666551f5880/ 97 B
599 B 173ms
166ms XHR
application/json 2606:4700::6810:787f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/p/c666551f5880/quotes

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:787f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

66febffd83a54b7d75c7d4cb0575275976a379b5abea6a46ac578739d9ee06e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

X-Client-Date: 1553511863180
Origin: https://doublepulsar.com
X-XSRF-Token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
X-Obvious-CID: web

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 200
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
link: <https://medium.com/humans.txt>; rel="humans"
x-obvious-tid: 1553511863413:8020a54361d1
server: cloudflare
x-frame-options: sameorigin
tk: T
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://doublepulsar.com
access-control-expose-headers: X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, X-Obvious-Profiling, X-Diagnostics, x-opentracing
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 4bd06759fc8763d9-FRA
x-opentracing: {"ot-tracer-spanid":"0f60cfea40f1b241","ot-tracer-traceid":"11766edd2bc816bc","ot-tracer-sampled":"true"}
expires: Thu, 09 Sep 1999 09:09:09 GMT

GET
H2 200 YxtzyIn-_normal.jpg
pbs.twimg.com/profile_images/1090532352223297536/ Frame 61E8 2 KB
3 KB 12ms
11ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1090532352223297536/YxtzyIn-_normal.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40D0) /

Resource Hash

c49d48699c7c178e0a655e09d1292f7a9126a17dd67f890a7052b739f03415fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-response-time: 143
date: Mon, 25 Mar 2019 11:04:23 GMT
x-content-type-options: nosniff
surrogate-key: profile_images profile_images/bucket/3 profile_images/1090532352223297536
last-modified: Wed, 30 Jan 2019 08:47:08 GMT
server: ECS (fcn/40D0)
access-control-allow-origin: *
x-cache: HIT
content-type: image/jpeg
status: 200
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: ba942ed2960b6ce172cec9b6f78ec992
accept-ranges: bytes
content-length: 2415

GET
DATA 200
OK truncated
/ Frame 61E8 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 61E8 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4468e35646c229b518e5f398c5a3d6b15ba1351a71ef22692129bb32f5030ac0

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 61E8 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0341a4478ce861ef85c819b913fa0a2501836a6a2ffda8643e95e39f4a2a7de0

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 61E8 707 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 61E8 835 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e8d9c376f9c2619e8812440b680d6b28c3ed51cb6e7e71ea877fe5441aa9215

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 61E8 323 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3531ed2c934e5daee80955db42a0245d666131e6322c6ec6985992922520ab4

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

OPTIONS
H2 204 responsesStream Show response
medium.com/_/api/posts/c666551f5880/ 0
147 B 142ms
142ms XHR
text/plain 2606:4700::6810:7a7f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/_/api/posts/c666551f5880/responsesStream?filter=best

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7a7f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://medium.com:443 https://.medium.com:443 https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Access-Control-Request-Method: GET
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,x-client-date,x-obvious-cid,x-opentracing,x-xsrf-token

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 204
access-control-max-age: 86400
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
access-control-allow-headers: Accept, Content-Type, Origin, User-Agent, DNT, Cache-Control, X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, x-opentracing
x-obvious-tid: 1553511863520:7d3c59a385e
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://doublepulsar.com
cache-control: no-cache
access-control-allow-credentials: true
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com:443 https://*.medium.com:443 https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
cf-ray: 4bd0675a8be096e2-FRA
link: <https://medium.com/humans.txt>; rel="humans"

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 127 B
325 B 106ms
106ms XHR
application/json 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e348da9b2c10637beb098fa5847de3d3d829c0e9dfae4682eab85903612fedcb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 127

GET
H2 200 responsesStream Show response
medium.com/_/api/posts/c666551f5880/ 202 B
281 B 175ms
175ms XHR
application/json 2606:4700::6810:787f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/_/api/posts/c666551f5880/responsesStream?filter=best

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:787f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

c31806ec7f06afefd06c2a5629b08512392cf1b2635b19d29451793d7bbe64b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

X-Client-Date: 1553511863440
Origin: https://doublepulsar.com
X-XSRF-Token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json
X-Obvious-CID: web
Accept: application/json
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
x-opentracing: {"ot-tracer-spanid":"1e7da2060986bc","ot-tracer-traceid":"87b18b23ea709","ot-tracer-sampled":"true"}

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 200
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1553511863662:270cf9529d41
server: cloudflare
x-frame-options: sameorigin
tk: T
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://doublepulsar.com
access-control-expose-headers: X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, X-Obvious-Profiling, X-Diagnostics, x-opentracing
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 4bd0675b8df463d9-FRA
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

GET
H/1.1

200
OK

jot.html
platform.twitter.com/ Frame 6C3D
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

0
0

12ms
11ms

Document
text/html

2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E2) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Mar 2019 11:04:23 GMT
Etag: "d9592a6c704736fa4da218d4357976dd"
Last-Modified: Thu, 07 Mar 2019 17:40:21 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40E2)
X-Cache: HIT
Content-Length: 80

Redirect headers

status: 302 302 Found
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
content-type: text/html;charset=utf-8
date: Mon, 25 Mar 2019 11:04:23 GMT
expires: Tue, 31 Mar 1981 05:00:00 GMT
last-modified: Mon, 25 Mar 2019 11:04:23 GMT
location: https://platform.twitter.com/jot.html
pragma: no-cache
server: tsa_o
strict-transport-security: max-age=631138519
x-connection-hash: 32acbd7e1c350bc32012979a994e0976
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 140
x-transaction: 0070288b005e9462
x-tsa-request-body-time: 0
x-twitter-response-tags: BouncerCompliant
x-xss-protection: 0

GET
H2 200 responses Show response
medium.com/_/api/posts/c666551f5880/ 153 B
245 B 148ms
147ms XHR
application/json 2606:4700::6810:787f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/_/api/posts/c666551f5880/responses?filter=best

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:787f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

31667262e754a8eed011771661f075076f448fe3ea8af1501e3a3453d6e16e1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

X-Client-Date: 1553511863182
Origin: https://doublepulsar.com
X-XSRF-Token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json
X-Obvious-CID: web
Accept: application/json
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
x-opentracing: {"ot-tracer-spanid":"268f5b9f540d4","ot-tracer-traceid":"4ec01f8b9d774","ot-tracer-sampled":"true"}

Response headers

date: Mon, 25 Mar 2019 11:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 200
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1553511863753:63a955c9fc6
server: cloudflare
x-frame-options: sameorigin
tk: T
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://doublepulsar.com
access-control-expose-headers: X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, X-Obvious-Profiling, X-Diagnostics, x-opentracing
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 4bd0675c1e5963d9-FRA
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
342 B 464ms
464ms XHR
application/json 2600:9000:200d:3e00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:3e00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: y-GXBePWx4TCu3roAReDky22OUiPf9HEYmBAMntUUdfitL0eShwn7Q==

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 111ms
110ms XHR
text/plain 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 25 Mar 2019 11:04:23 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

OPTIONS
H2 204 placements Show response
medium.com/_/api/ 0
172 B 128ms
128ms XHR
text/plain 2606:4700::6810:7a7f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/_/api/placements?requestContext%5BpostPageContext%5D%5BpostId%5D=c666551f5880&requestContext%5BcontextType%5D=postPageContext&slots%5B0%5D%5Blocation%5D=1&slots%5B0%5D%5Bindex%5D=0

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7a7f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://medium.com:443 https://.medium.com:443 https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Access-Control-Request-Method: GET
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,x-client-date,x-obvious-cid,x-opentracing,x-xsrf-token

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 204
access-control-max-age: 86400
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
access-control-allow-headers: Accept, Content-Type, Origin, User-Agent, DNT, Cache-Control, X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, x-opentracing
x-obvious-tid: 1553511864011:d38d53c64497
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
access-control-allow-origin: https://doublepulsar.com
cache-control: no-cache
access-control-allow-credentials: true
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com:443 https://*.medium.com:443 https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io https://app.zencoder.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
cf-ray: 4bd0675da91d96e2-FRA
link: <https://medium.com/humans.txt>; rel="humans"

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 127 B
325 B 104ms
103ms XHR
application/json 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: 9b8a7e8de340940a0cc10d6dbb4b7c622c39605af244578c9417818e7b20e93b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 127

GET
H2 200 placements Show response
medium.com/_/api/ 35 KB
8 KB 403ms
402ms XHR
application/json 2606:4700::6810:787f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://medium.com/_/api/placements?requestContext%5BpostPageContext%5D%5BpostId%5D=c666551f5880&requestContext%5BcontextType%5D=postPageContext&slots%5B0%5D%5Blocation%5D=1&slots%5B0%5D%5Bindex%5D=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:787f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Medium

Resource Hash

f13e85714368a5d5ced6f0d5e8958815510aca6736e920fcd246f6bddecfbef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

X-Client-Date: 1553511863943
Origin: https://doublepulsar.com
X-XSRF-Token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json
X-Obvious-CID: web
Accept: application/json
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
x-opentracing: {"ot-tracer-spanid":"1ccc155a6277e1","ot-tracer-traceid":"1f046fa51f48ca","ot-tracer-sampled":"true"}

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 200
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1553511864135:9aba03c38467
server: cloudflare
x-frame-options: sameorigin
tk: T
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://doublepulsar.com
access-control-expose-headers: X-Xsrf-Token, X-Obvious-Cid, X-Client-Date, X-Obvious-Profiling, X-Diagnostics, x-opentracing
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 4bd0675e785263d9-FRA
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
342 B 174ms
173ms XHR
application/json 2600:9000:200d:3e00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:3e00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: XpZvUpR61MboFVfT4peTNVu9FMsgnerZ-mf3wvSWv25hH8Fw_9AEMg==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
343 B 612ms
612ms XHR
application/json 2600:9000:200d:3e00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:3e00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: hTsNM8DcPMfs5V8qDVeoBx34cBYw_Z8GO28GGjHDuYkNUnCCknVWSA==

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
cdn-images-1.medium.com/fit/c/36/36/ 2 KB
2 KB 22ms
21ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/36/36/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

49d968f60654979a77d05e95c4264afae4d4b75f97dab7fc975528f0ba12f765

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 1661
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06761a8dcc283-FRA
expires: Wed, 24 Apr 2019 11:04:24 GMT

GET
H2 200 1*9WbXEpOxOhaMq99CwG1ESQ.png
cdn-images-1.medium.com/fit/c/36/36/ 3 KB
3 KB 25ms
23ms Image
image/png 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/36/36/1*9WbXEpOxOhaMq99CwG1ESQ.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

b0815db5b7c6eade81089a9bd3156d1b0d15bcdc33ddf4019fec91031d9239ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 2938
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06761a8dec283-FRA
expires: Wed, 24 Apr 2019 11:04:24 GMT

GET
H2 200 1*wq6OURHLVVme_NrQ1QKWig.png
cdn-images-1.medium.com/fit/c/36/36/ 3 KB
3 KB 22ms
21ms Image
image/png 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/36/36/1*wq6OURHLVVme_NrQ1QKWig.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

bed8ce937733b9c92dbe9084c81ef27d6f60be859fcb2f244f44cd166209300c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3186-c68af25
status: 200
vary: Accept-Encoding
content-length: 2604
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06761a8dfc283-FRA
expires: Wed, 24 Apr 2019 11:04:24 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 109ms
108ms XHR
text/plain 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 25 Mar 2019 11:04:24 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

GET
H2 200 1*ayrs-c5kyUqIuLskDCErvw.png
cdn-images-1.medium.com/fit/c/400/120/ 111 KB
111 KB 22ms
20ms Image
image/png 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/400/120/1*ayrs-c5kyUqIuLskDCErvw.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

57318970f383436309aa4c79ebd6a929a072faea81c40fbf182042778374b673

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 113499
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06761b92cc283-FRA
expires: Wed, 24 Apr 2019 11:04:24 GMT

GET
H2 200 1*YDlbuijY1qh1K0WhSIRFKw.png
cdn-images-1.medium.com/fit/c/400/120/ 33 KB
33 KB 23ms
21ms Image
image/png 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/400/120/1*YDlbuijY1qh1K0WhSIRFKw.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

42899f814c432a23ca6971c41fdf84f73516966acfbba59be2bb08a0acf79e35

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 34180
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06761b92ec283-FRA
expires: Wed, 24 Apr 2019 11:04:24 GMT

GET
H2 200 1*3pJ2G4fRvmvgNyVf6lX0YQ.jpeg
cdn-images-1.medium.com/fit/c/400/120/ 14 KB
14 KB 17ms
16ms Image
image/jpeg 2606:4700::6810:7791
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/fit/c/400/120/1*3pJ2G4fRvmvgNyVf6lX0YQ.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d1bf4289c0d1a7f65cdedb34af45766a12f6286cbac04c11ec855594bcc3a1aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
vary: Accept-Encoding
content-length: 13963
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4bd06761b92fc283-FRA
expires: Wed, 24 Apr 2019 11:04:24 GMT

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 127 B
325 B 103ms
103ms XHR
application/json 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: f5fb8ce377c6058846ae09a0adde36b2e15252d69fc8e812c5fed241eee58958

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 25 Mar 2019 11:04:24 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 127

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 103ms
102ms XHR
text/plain 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 25 Mar 2019 11:04:25 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 127 B
325 B 107ms
106ms XHR
application/json 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e87ed2a3f939fe9e5327c80de2f9701bd776c8bc426f60d3df5d5c2925414b98

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 25 Mar 2019 11:04:25 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 127

POST
H2 409 batch Show response
doublepulsar.com/_/ 115 B
1 KB 237ms
237ms XHR
application/json 52.1.119.170
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/_/batch

Requested by

Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.119.170 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-1-119-170.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

21e13ebdec5d40b26ed12a17e67b57b19ef133b309702867d20418b7ff702040

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

cookie: sz=1585; pr=1
origin: https://doublepulsar.com
x-xsrf-token: 1
accept-encoding: gzip, deflate, br
x-obvious-cid: web
content-length: 32851
:path: /_/batch
pragma: no-cache
x-client-date: 1553511867623
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type: application/json
accept: application/json
cache-control: no-cache
:authority: doublepulsar.com
referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
:scheme: https
:method: POST
X-Client-Date: 1553511867623
Origin: https://doublepulsar.com
X-XSRF-Token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
X-Obvious-CID: web

Response headers

date: Mon, 25 Mar 2019 11:04:27 GMT
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 36997-a1784da,a1784da5ffa
status: 409
content-length: 115
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
link: <https://medium.com/humans.txt>; rel="humans"
x-obvious-tid: 1553511867786:49e85e721c5b
server: nginx
x-frame-options: sameorigin
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
set-cookie: uid=; path=/; expires=Mon, 25 Mar 2019 11:04:26 GMT; domain=doublepulsar.com; secure; httponly sid=; path=/; expires=Mon, 25 Mar 2019 11:04:26 GMT; domain=doublepulsar.com; secure; httponly uid=; path=/; expires=Mon, 25 Mar 2019 11:04:26 GMT; domain=.doublepulsar.com; secure; httponly sid=; path=/; expires=Mon, 25 Mar 2019 11:04:26 GMT; domain=.doublepulsar.com; secure; httponly uid=; path=/; expires=Mon, 25 Mar 2019 11:04:26 GMT; secure; httponly sid=; path=/; expires=Mon, 25 Mar 2019 11:04:26 GMT; secure; httponly
x-opentracing: {"ot-tracer-spanid":"118aad5352b96214","ot-tracer-traceid":"205557a56705070c","ot-tracer-sampled":"true"}
expires: Thu, 09 Sep 1999 09:09:09 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 103ms
102ms XHR
text/plain 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-static-1.medium.com
URL: https://cdn-static-1.medium.com/_/fp/gen-js/main-base.bundle.pMGS2qxCm3kUTnzA7qtQ0Q.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 25 Mar 2019 11:04:27 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 127 B
325 B 103ms
103ms XHR
application/json 18.204.136.127
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.136.127 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-136-127.compute-1.amazonaws.com
Software: /
Resource Hash: a9e8d06d0cd4fd6c23b836d463f4bfcfacbca23902642500f35ececc6b80cf17

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 25 Mar 2019 11:04:27 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 127

GET
H/1.1 200
OK /
srv-2019-03-25-11.pixel.parsely.com/event/ 43 B
385 B 104ms
104ms Image
image/gif 35.153.236.75
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2019-03-25-11.pixel.parsely.com/event/?rand=1553511872998&plid=57854132&idsite=medium.com&url=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880%3Fgi%3D4d2b90239266&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fdoublepulsar.com%2Fhow-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880%3Fgi%3D4d2b90239266&sref=&sts=1553511872998&slts=0&date=Mon+Mar+25+2019+11%3A04%3A32+GMT%2B0000+(Coordinated+Universal+Time)&action=heartbeat&inc=5&tt=4900&pvid=16088001&u=pid%3D7264555cdc43a8aea8e5e7bd13120190
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.236.75 Seattle, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-35-153-236-75.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Mar 2019 11:04:33 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="CUR ADM OUR NOR STA NID"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.6e5b62723488aee38af0c77681396a5b.js

Domain: platform.twitter.com
URL: https://platform.twitter.com/js/tweet.2b7769d244a8dfeb3ab9d97583412dec.js

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://doublepulsar.com https://.doublepulsar.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io https://app.zencoder.com 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abs.twimg.com
api2.branch.io
app.link
cdn-images-1.medium.com
cdn-static-1.medium.com
cdn.branch.io
cdn.syndication.twimg.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
doublepulsar.com
glyph.medium.com
i.embed.ly
medium.com
pbs.twimg.com
platform.twitter.com
srv-2019-03-25-11.pixel.parsely.com
syndication.twitter.com
www.google-analytics.com
platform.twitter.com
104.16.90.50
104.244.42.72
13.35.253.62
13.35.254.99
18.204.136.127
2600:9000:200d:1a00:19:9934:6a80:93a1
2600:9000:200d:3e00:11:f728:3040:93a1
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2606:4700::6810:7591
2606:4700::6810:7791
2606:4700::6810:787f
2606:4700::6810:7a7f
2a00:1450:4001:824::200e
35.153.236.75
52.1.119.170
00ee87fc8aab7dcd28e2cf9771427b084359bba3fa5f1ef0b4c4a0c533d834df
01925fca42df9c862374a00188a2c240464740242e1c5f2ffd8735d8a4d72b27
0341a4478ce861ef85c819b913fa0a2501836a6a2ffda8643e95e39f4a2a7de0
05e3a889ba8070cdb0233a70af8761b882ebb3c843ff5340a86a3dd15ecdb3e8
06399f318b8adceecbbfcc8371aef8f7716609e5036f461019ad3e76d6d5a1ff
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
0a8ffdb922f0525a50cdc117bda012e2e5eb1f2281fe5189a0cb37499b1a446b
0d9939299f78f1ae25a7b133ed5f9ba06c00af6ccf0fb8a9a94f74f23f29efff
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
21e13ebdec5d40b26ed12a17e67b57b19ef133b309702867d20418b7ff702040
31667262e754a8eed011771661f075076f448fe3ea8af1501e3a3453d6e16e1f
338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29
396e55a2b5b01136ae516c883ff9dea7faecea8d58f6e91d6c0bbdd420c813c8
399c7f76001ab13bfa085f0ebd942150a706b9bf02ba03c562ea5149de5734ca
3c06e5f8a1bcaa33b3e54ebbb4908038d04da5c81b29c040c0ce09771b7b51ad
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9
42899f814c432a23ca6971c41fdf84f73516966acfbba59be2bb08a0acf79e35
4468e35646c229b518e5f398c5a3d6b15ba1351a71ef22692129bb32f5030ac0
44704d3f11b7eea4bc6bdd815eb26c4ad55e13f2274fb0d338bba8274c43a50f
460c112ca18e517ef1a6c6abb2ba5ae55187138503a10177bf1908d9261c3a19
48b612477d7a718ad054a6c46be64c13f6610325ed1d8979db008b1c021ac8c9
49d968f60654979a77d05e95c4264afae4d4b75f97dab7fc975528f0ba12f765
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
54b58bff818df7ac7c2785286dc32585b101d19ebec193fdb7da0e76dbf97e73
5657eadb053d8a3a0aeabd467171a76e3a017dd22eae48c1ea3516c4b417ffa4
57318970f383436309aa4c79ebd6a929a072faea81c40fbf182042778374b673
66febffd83a54b7d75c7d4cb0575275976a379b5abea6a46ac578739d9ee06e3
6aa27d4543eb33a99a229f4312df8f8ed823ec3a6bd2b281e6afc784d0d5ff31
6e59708a37ef1a3e666ca1fb98528e3fde7e2a4628a1fd7e795a0a98b8759329
7e8d9c376f9c2619e8812440b680d6b28c3ed51cb6e7e71ea877fe5441aa9215
81e3ca1be527a50f43fd3e340df21379473a569bbbc87f8606d42951446f937f
8222827f30af9fde51d3606dc61f0adec462f14a7128c48bf45052fa4aaaf4da
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a548a3f01f6d92045be9ae44e89520ed11505928139d831749385a36aee74c
8778929fff9f35ff06f7b818e30b2ce6bafc4518858b37f86580924e31196100
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
9b8a7e8de340940a0cc10d6dbb4b7c622c39605af244578c9417818e7b20e93b
9c6ea1ab4588c0be7dc9cb629aa641415dd91acaea7084de6921a7ffa2299bfb
9cb742bdb7a3734e5ffba85c9acb9772e1b74e22bc3fa58fd3563ac31a8d467d
a1a9f0f2844d80ca5a41f2d483d56d674eb333e570706b935cf46add6aa2f31d
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
a9e8d06d0cd4fd6c23b836d463f4bfcfacbca23902642500f35ececc6b80cf17
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0815db5b7c6eade81089a9bd3156d1b0d15bcdc33ddf4019fec91031d9239ae
b5e98b4bc41f421981af91804a14836e78816f30d3ba7ce7acf61debd666b53e
bc72a2ca45067a3d17fed4cd8776fec5dca3b9ecd7300e107f9256a86a0c8b2f
bed8ce937733b9c92dbe9084c81ef27d6f60be859fcb2f244f44cd166209300c
c139b8dd7b1ccda2813ae79d127d1c0256f91a71fce5581887a1d5fbbca81bde
c31806ec7f06afefd06c2a5629b08512392cf1b2635b19d29451793d7bbe64b7
c3531ed2c934e5daee80955db42a0245d666131e6322c6ec6985992922520ab4
c49d48699c7c178e0a655e09d1292f7a9126a17dd67f890a7052b739f03415fc
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e19a719a047db27e6d01dac74c3845f4e26ee27c15f0ae5cbc0ff78b6864e0
d1bf4289c0d1a7f65cdedb34af45766a12f6286cbac04c11ec855594bcc3a1aa
d2b15b586d9bef47b35288575d6a7d7b37ddd2ea931a76f4ede918d15c7067b1
d49f9d5f6cf0fe5e246dae163447d21a876c54cdf3da502fca7d95f2441a51a6
d81ad0278108873cc76f97aa61cbf62baeef7b3cca383d90aa1c31cfa1b1629f
dd288ea9c54b0fd8feedd3de8e2c91e77ca2fa58380945665ee83d54fc808aa0
ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5
e26fdccb214e020f70cf2aede7b77d5dc51854e23b3acbb4bcff0018773a636f
e2e081ca0b071382f8aa06efe5cf9e599f0dc687fcb5f1cecba35e6686d1f663
e348da9b2c10637beb098fa5847de3d3d829c0e9dfae4682eab85903612fedcb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5fce34cf8275fb2efbcf70a61073863d0cc68053ad34e13aadc46d9f0a33392
e87ed2a3f939fe9e5327c80de2f9701bd776c8bc426f60d3df5d5c2925414b98
ea9e51ae2db8e599770b1eb6f450fc9d6f7ac11da8acb638738fcb82d650bf4e
ecd4e7d93b0e021e5aa40a1589b5aa70dba23d80f9cb9020998bd3ead915226d
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
f03c244c32a2fc980cfee708e0813bf36c60483e9f8ed9c0b657fcc1d15bc4e5
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
f13e85714368a5d5ced6f0d5e8958815510aca6736e920fcd246f6bddecfbef3
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
f5fb8ce377c6058846ae09a0adde36b2e15252d69fc8e812c5fed241eee58958
f722324dc9170337b1ff06d47e34550df9c0a5e6bb8a6c3fc6f1387a43127320
ffe536c89e72e825974d7180e35234e50aa14cec4870f59fad365e509fc7efde

doublepulsar.com Open in urlscan Pro 52.1.119.170 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

86 Requests

98 %HTTPS

59 %IPv6

11 Domains

18 Subdomains

18 IPs

2 Countries

1351 kBTransfer

3664 kBSize

0 Cookies

14 Outgoing links

Page URL History

Redirected requests

86 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

doublepulsar.com Open in urlscan Pro
52.1.119.170 Public Scan

Screenshot
Live screenshot

Full Image

86
Requests

98 %
HTTPS

59 %
IPv6

11
Domains

18
Subdomains

18
IPs

2
Countries

1351 kB
Transfer

3664 kB
Size

0
Cookies

86 HTTP transactions
10 data transactions