www.sophos.com Open in urlscan Pro
104.111.233.221  Public Scan

21 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1390821283&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&utmhid=400020029&utmr=-&utmp=%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&utmht=1602106320723&utmac=UA-737537-1&utmcc=__utma%3D1.610981894.1602106321.1602106321.1602106321.1%3B%2B__utmz%3D1.1602106321.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=350172746&utmredir=3&utmu=q1AAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=610981894.1602106321&jid=350172746&_v=5.7.2dc&z=1390821283 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=610981894.1602106321&jid=350172746&_v=5.7.2dc&z=1390821283&slf_rd=1&random=815133193

Request Chain 73

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=1600747181&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&utmhid=400020029&utmr=-&utmp=%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&utmht=1602106320729&utmac=UA-737537-18&utmcc=__utma%3D1.610981894.1602106321.1602106321.1602106321.1%3B%2B__utmz%3D1.1602106321.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1529099834&utmredir=3&utmmt=1&utmu=q1AgAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=610981894.1602106321&jid=1529099834&_v=5.7.2dc&z=1600747181 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=610981894.1602106321&jid=1529099834&_v=5.7.2dc&z=1600747181&slf_rd=1&random=518497094

Request Chain 82

• https://s1777052651.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1777052651&ref2=elqNone&tzo=-60&ms=967&optin=disabled HTTP 302
• https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=-60&ms=967&optin=disabled&elqCookie=1

Request Chain 85

• https://9816844.fls.doubleclick.net/activityi;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx HTTP 302
• https://9816844.fls.doubleclick.net/activityi;dc_pre=CIfJpJG3o-wCFcHGuwgdx_oOkA;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx

Request Chain 106

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1602106321147&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1602106321147%26url%3Dhttps%253A%252F%252Fwww.sophos.com%252Fen-us%252Fthreat-center%252Fthreat-analyses%252Fviruses-and-spyware%252FW32%257EBrontok-AJ%252Fdetailed-analysis.aspx%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1602106321147&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32%7EBrontok-AJ%2Fdetailed-analysis.aspx&liSync=true

Request Chain 112

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AAU0GE6-_GgAABDfNqy42Q HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAU0GE6-_GgAABDfNqy42Q&verifyHash=288bc0bae5c2069f7ae44d0100af0d986d7db093

Request Chain 125

• https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&rl=&if=false&ts=1602106322677&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5Cn%5CtDetailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center%5Cn%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.27&r=stable&ec=1&o=30&fbp=fb.1.1602106321173.903688207&it=1602106321081&coo=false&es=automatic&tm=3&rqm=GET HTTP 302
• https://cx.atdmt.com/?c=10195433778124427995&f=AYxdTw4iMHKekY-Tlf6-wcZu4SndPBmZnOim8GUrrnWCjCMXEEJsdtd81tq4WsbZLj3ZdRKX9vexzFIHtCMgRpf7&id=334990480506518&l=3&v=0

125 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request detailed-analysis.aspx Show response www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/	59 KB 19 KB	105ms 41ms	Document text/html	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 9d81e843b9a5fef3d1b362fa502c1d5ba97d56f37c72d94535371552506b39e5 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.sophos.com :scheme https :path /en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 content-type text/html; charset=utf-8 last-modified Fri, 18 May 2018 19:04:42 GMT x-ua-compatible IE=edge x-frame-options SAMEORIGIN strict-transport-security max-age=10886400 x-xss-protection 1; mode=block x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin vary Accept-Encoding content-encoding gzip x-akamai-transformed 9 - 0 pmb=mTOE,2mRUM,2 cache-control public, max-age=900 expires Wed, 07 Oct 2020 21:47:00 GMT date Wed, 07 Oct 2020 21:32:00 GMT content-length 17917 set-cookie websiteaklang=en-us; expires=Fri, 09-Oct-2020 21:32:00 GMT; path=/; domain=.sophos.com ak_bmsc=0961479C117AB91CD3952AAF06F659780210BB15C6580000D0337E5F7E33A125~plA2g6klfSOY4f/h6WBDD1oCQ7W0nK5PNSkX7N7Y/07o6g0yftGUXupPt2lf7P2tbwDTPxHjm3xo7MQw1aBc7+tIyHKIXulBDK/Z2squAsLtfs0HcXmYaItg3sA+GTDpVXZR7jxv86za71KALjwmS/4jOqdF6K/3R8cJwO0PlYQvIMB7X/bhg9U+8Dh2pDQR19Fb4NUoOcbHglbCd3Knpso5WOM0TuZ78RQ++mSS50Llw=; expires=Wed, 07 Oct 2020 23:32:00 GMT; max-age=7200; path=/; domain=.sophos.com; HttpOnly bm_mi=8008EFBF73BA0AD6710B3788D10F51B7~XhmxjhUJk5tHBtrWXcBxtNJczqh/09RdACS/iaA9xTZWEQmKlbweLfhngrF4D54wiQmDuisMfEBcWvI7Lux+Fc+R7eijKdpKGIXE0xniqHr9ccoAarWY68zJn82OXHNNBnCwCeMz/EkctVKlHLAlg+DHtwS/QvdBMLl/L/K+5elfFFOaRaUrwO3jPriVJUDffvmV5SiNTRhoI973/aGLOQk1NiCA2LrDjZwh/TGpKEGbLWH/uDBwQ5G53R1nMg8PDnNZfSlV+zFBjyNy/aqL+LeACRWeGDW4OPM5xUg8xYSy5evd6OrRXvTT3Lbc3+alwNQ3Mlv5aNw2VCxjOw3WSpXrhYZzdkP/QEKHM4zasUA=; Domain=.sophos.com; Path=/; Max-Age=0; HttpOnly server-timing cdn-cache; desc=HIT edge; dur=1 edge-sophos-cookie-lang en-us
GET H2	200	Legacy.css www.sophos.com/Styles/Bundles/	73 KB 13 KB	116ms 116ms	Stylesheet text/css	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/Styles/Bundles/Legacy.css?v=1 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 70b2c85c2a1e64a8bf5a7080944b925350eac2df76e3115bca01ff0d7e903db4 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding br etag 74860e4a0a98c4d21b579a9a0e04aa37 status 200 sophos-redirection 509 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 12542 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 30 Sep 2020 22:11:06 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type text/css cache-control public, max-age=51763 x-content-type-options nosniff expires Thu, 08 Oct 2020 11:54:43 GMT
GET H2	200	global.js Show response www.sophos.com/scripts/bundles/	699 KB 178 KB	195ms 194ms	Script text/javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/scripts/bundles/global.js?v=5 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash ef0aa969f2d6d6a78d4f43679f500dcd1b0a757012374ae5643b5e3a4d440f0d Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 145 strict-transport-security max-age=10886400 content-encoding br x-content-type-options nosniff x-edgeconnect-midmile-rtt 65 status 200 sophos-redirection 508 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 180994 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Sun, 04 Oct 2020 11:04:18 GMT etag aa11b354cf3922f80c7bbfcfa78807ae x-frame-options SAMEORIGIN content-type text/javascript cache-control public, max-age=31446 date Wed, 07 Oct 2020 21:32:00 GMT expires Thu, 08 Oct 2020 06:16:06 GMT
GET H2	200	Global.css www.sophos.com/Styles/Bundles/	484 KB 63 KB	161ms 161ms	Stylesheet text/css	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/Styles/Bundles/Global.css?v=7 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 2fa29d633cec9b055e19658b6e9a2328a3da15b8a3947b76912b6b634b3feaeb Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding br etag 8920fdb7132cad3f3afd9cb99ce03a8a status 200 sophos-redirection 509 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 63574 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 30 Sep 2020 22:16:07 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type text/css cache-control public, max-age=38929 x-content-type-options nosniff expires Thu, 08 Oct 2020 08:20:49 GMT
GET H2	200	nonhtmltracking.js Show response www.sophos.com/en-us/medialibrary/scripts/tracking/	2 KB 876 B	58ms 42ms	Script application/x-javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/en-us/medialibrary/scripts/tracking/nonhtmltracking.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 9f3c45aae8d14cee7c2fa3bcd7604c6936a4886ff864fb743e11dc61705cd516 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding br x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 515 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Sat, 03 Oct 2020 13:41:16 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type application/x-javascript cache-control private, max-age=300 expires Wed, 07 Oct 2020 21:37:00 GMT
GET H2	200	39cb5df0 Show response www.sophos.com/akam/11/	32 KB 11 KB	74ms 58ms	Script application/javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/akam/11/39cb5df0 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 9a4066bbb996db286b5dfa2ba78bc6f41faf6b6d1a30dc65f6afec8dd3e25d30 Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT content-encoding gzip last-modified Thu, 02 May 2019 20:06:34 GMT etag "d0c1325b7d3cc325bfeef2b2370a3dcdbb89f3091d889f30295d967bbf82d1d5" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=0, no-cache, no-store server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 10429 expires Wed, 07 Oct 2020 21:32:00 GMT
GET H2	200	WebResource.axd Show response www.sophos.com/	23 KB 6 KB	307ms 306ms	Script application/x-javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZJOSk0UCLAIsVcp1lGhjDOtuIgnMJ-Grvo38PGQgf8V85Jrv0w2&t=637290814998988531 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 6158 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 30 Jun 2020 01:38:19 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=36714 expires Thu, 08 Oct 2020 07:43:54 GMT
GET H2	200	WebResource.axd Show response www.sophos.com/	350 B 733 B	488ms 487ms	Script application/x-javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/WebResource.axd?d=3WTd45ClInYAUa1dBtg1Dx3scYg9bCub9YQFIdxPHkSTB8jCCAZuRBuMGXYyiUTcH0_h7qtwgZh_UAS8UQ22cCAx3Q3OFyzyESB-cDl3avMWoV6j73u70f0iz2KiFVj0m3Ddo5IgxrGe8w9egmF4tzC1T4nGrqyOvfP2Qft-th9rBC06C1XuFLlbq1xBaG0D20oqDw2&t=637351538860000000 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 189a7158414e4fab1d24249e6eef0b73fcf61dc28c070fb90da996ca9936f111 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 08 Sep 2020 08:24:46 GMT date Wed, 07 Oct 2020 21:32:00 GMT x-frame-options SAMEORIGIN content-type application/x-javascript status 200 x-xss-protection 1; mode=block cache-control public, max-age=172800 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=143, origin; dur=83 vary Accept-Encoding content-length 350 x-content-type-options nosniff expires Fri, 09 Oct 2020 21:32:00 GMT
GET H2	200	ScriptResource.axd Show response www.sophos.com/	100 KB 34 KB	308ms 307ms	Script application/x-javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/ScriptResource.axd?d=uHIkleVeDJf4xS50Krz-yN1ZvwfhxvHncooXRVKlBTvhmoCy5bupVsuGQkkLDTjm_jeXn8iO6HKP26I7IDatS8OjrL3TZARrPj65IRkIyM0vqtH5ucJW9TRfUMNR2gGqjWeoyvt0XQhPDZePYL5A24lVIUM1&t=2a797f5c Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 34659 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 06 Oct 2020 07:43:46 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=36712 expires Thu, 08 Oct 2020 07:43:52 GMT
GET H2	200	ScriptResource.axd Show response www.sophos.com/	39 KB 14 KB	345ms 345ms	Script application/x-javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/ScriptResource.axd?d=Jw6tUGWnA15YEa3ai3FadNldxw-oCDto7EOAGJmZziNa8LT7qiasmCz0ObdMfKLRM0A-Bp6BZcpUP_cUC_iK-o_OwnHmAvTfphOefNoD-JNhN4rMOvpecOoqdhPDdFOnQg07auL3O_3RWt5JqB-KKiM6gEM1&t=2a797f5c Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 398cdf1b27ef247e5bc77805f266bb441e60355463fc3d1776f41aae58b08cf1 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 13651 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 06 Oct 2020 07:43:50 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=36725 expires Thu, 08 Oct 2020 07:44:05 GMT
GET H2	200	CoveoSearchmin%20v2-3679.js Show response www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/medialibrary/Scripts/	1 MB 526 KB	388ms 388ms	Script application/x-javascript	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/medialibrary/Scripts/CoveoSearchmin%20v2-3679.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 51af653aaeac48e9f003b38ff7d62622cd5810c4378e0e71952d78ef03d714d1 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 536926 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 16 Sep 2019 14:15:20 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type application/x-javascript cache-control private, max-age=300 expires Wed, 07 Oct 2020 21:37:00 GMT
GET H2	200	sophos-logo.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Header-Navigation/	2 KB 1 KB	74ms 58ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Header-Navigation/sophos-logo.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash a55150a4cc33c9d0e381368e1b4d6170a7fde72ecba6de0ab043b3dc43dfad73 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1084 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 07 Feb 2019 19:59:02 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	navigation-accordian-img2.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/	733 B 1 KB	515ms 499ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/navigation-accordian-img2.svg?h=34&&w=34&la=en&hash=FCE1C766C4188FD9B0E9173F3C1F0E7241DCCA05 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 517a16fedc3c2f5ba86a4c4c9567552088e1572016fc835ba0bd79e83bdd1c6e Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Mon, 20 Aug 2018 15:48:35 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=199, origin; dur=225 vary Accept-Encoding content-length 733 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	nav-close-icon.png www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/	1 KB 1 KB	155ms 140ms	Image image/png	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/nav-close-icon.png?h=24&&w=24&la=en&hash=60BCD18464B4DB8D822AA78F2AA7412BD7EF60F4 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 84553d0bcd17c6c5a9a3de8d260048f1af703fb83e7abbf6df6ffc5c0fbf3746 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 10 Mar 2017 09:43:50 GMT date Wed, 07 Oct 2020 21:32:00 GMT x-frame-options SAMEORIGIN content-type image/png status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1077 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:00 GMT
GET H2	200	product-icon-intercept-x.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	688 B 1 KB	533ms 518ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-intercept-x.svg?&w=45&la=en&hash=E4715ACE0E364CF26096C234E86279529C9A82E2 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 145b0e0edcce51e386c4c1a674a9d777166e20f8fbf5bd10b73a8080b6aa7330 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:48 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=181, origin; dur=233 vary Accept-Encoding content-length 688 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-icon-xg-firewall.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	615 B 1 KB	579ms 564ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-xg-firewall.svg?&w=45&la=en&hash=0F66B6A052951E7B2231DDCA370ABB0CB57FEE4B Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash b8b4a7db5a33552301787dbd129c7dd654de1f44f91e68bd392764211179e9d3 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:51 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=190, origin; dur=258 vary Accept-Encoding content-length 615 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	managed-threat-response-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	2 KB 1 KB	155ms 140ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/managed-threat-response-icon.svg?&w=45&la=en&hash=01678DFCF9D115CECD43A726986107D669FD7449 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 6c760ee2a072c2f89e03b02788fb718603d4f259e897a5a3661868276152d565 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 981 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Fri, 27 Sep 2019 12:58:05 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	sophos-cloud-optix-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	2 KB 1 KB	155ms 140ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/sophos-cloud-optix-icon.svg?&w=45&la=en&hash=DC0F928CDC12E05D820DF3EAC8612295BD81F69E Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 1aa1074ac493c7556cb00bcae26406eed2b2f8804e3f7ad00aa467dba16c83bc Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 866 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 18 Mar 2019 13:47:38 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	icon-central-promo.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	2 KB 2 KB	166ms 151ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/icon-central-promo.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash e8ebeb56f79d9c055fd45469fa305d773edfdf876e513699b6e3eb6de5ed9c5f Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1255 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:49 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	product-icon-secure-email-gateway.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	637 B 1 KB	590ms 575ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-secure-email-gateway.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 794c2d0a8da39c6f08f8d75acd015d4c8c47ccd2af7d5f934f7f31b25a3edd90 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:49 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=185, origin; dur=231 vary Accept-Encoding content-length 637 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-icon-sg-utm.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	975 B 1 KB	642ms 627ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-sg-utm.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash e1b293d96560e1b12aafc0b0798ead6291de4c789c78671fff5609cea24aeedc Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:50 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=218, origin; dur=239 vary Accept-Encoding content-length 975 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-icon-server-protection.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	788 B 1 KB	641ms 627ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-server-protection.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 2b14077e284034b90079461fa4bb78463a95717d233d611bdf69b68c4eb3b558 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:47 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=193, origin; dur=252 vary Accept-Encoding content-length 788 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-icon-secure-web-gateway.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	1 KB 1 KB	218ms 204ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-secure-web-gateway.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 3c812dd6b0bed0ad9b9ae4da55bf7ff542a2cb89fa915a6b2fe303d3dd07b072 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 709 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:49 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	product-icon-secure-wifi.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	768 B 1 KB	850ms 836ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-secure-wifi.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 130809624f7d5d6eb25fdbeb1f32d6b5ec80e885462ca1587af92fd5ef746329 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:50 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=166, origin; dur=466 vary Accept-Encoding content-length 768 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-icon-sophos-mobile.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	654 B 1 KB	668ms 655ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-sophos-mobile.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 89d3cb8cd3a0f672160c72ab7d507efb296d955715c42d49af6303b00606fa43 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:48 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=163, origin; dur=264 vary Accept-Encoding content-length 654 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-icon-phish-threat.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	1 KB 1022 B	260ms 246ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-phish-threat.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 9f94e93b3b0d408eeccf41b1ab0b60555f3d625b2ce413cd7c15f27fa8960507 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 666 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Mar 2018 17:32:32 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	product-icon-safeguard-encryption.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/	1 KB 871 B	260ms 247ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Products/Icons/product-icon-safeguard-encryption.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 6a20ef0ecab617495eff895519d1fe3e9830be0856c2d0099a6af249943185fb Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 514 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 08 Mar 2018 07:45:48 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	synchronized-security-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	3 KB 2 KB	278ms 265ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/synchronized-security-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 225b789a2cc049b3b17be426bf2e890a82e6163185335240239ce61738f6485a Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1710 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 15 Apr 2019 07:03:35 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	sophos-shield.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	537 B 990 B	693ms 680ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/sophos-shield.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash d89339e56c4b1644301ead7c71de7f1dc30c9dce47e2ec26aa3453f53b7abda8 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 Apr 2019 09:51:37 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=171, origin; dur=244 vary Accept-Encoding content-length 537 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	solutions-gear-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	666 B 1 KB	691ms 678ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/solutions-gear-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 071912f762efcf3f2f5181595e16be9b7504ca76dfd54f7b7fc45cc738afbca6 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 Apr 2019 09:51:37 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=154, origin; dur=250 vary Accept-Encoding content-length 666 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	icon-free-trials.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	391 B 844 B	744ms 731ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/icon-free-trials.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash b6ae9d3849ce587e2ece87c60ae43b58fb91507095ef6ba4c2c50bbea68cb179 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 Apr 2019 09:51:36 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=200, origin; dur=247 vary Accept-Encoding content-length 391 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	sophos-home-logo.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	12 KB 5 KB	316ms 303ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/sophos-home-logo.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 88a61de9f634aed9239ed836d1b8663a0cf3e866cbde6d418e7338af7c5713e8 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 5208 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 04 Nov 2019 05:26:13 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:08 GMT
GET H2	200	sophos-home-laptop-na.png www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	90 KB 91 KB	316ms 303ms	Image image/png	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/sophos-home-laptop-na.png?h=299&&w=571&la=en&hash=19E3536CD3BDC5F390B01E671BF6E5444A1C30C9 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 4973acd4738c54ca4d7f1647535c515ce923db783a75bf38f139db5816065fdc Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Mon, 17 Jun 2019 06:01:16 GMT date Wed, 07 Oct 2020 21:32:00 GMT x-frame-options SAMEORIGIN content-type image/png status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 92607 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:00 GMT
GET H2	200	partner-portal.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	669 B 1 KB	704ms 691ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/partner-portal.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 4df682882f9d0a5b69cb7dffdadff6aa6b17cc729b340e0573a7dd4e3221e922 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:26:19 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=157, origin; dur=221 vary Accept-Encoding content-length 669 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	partner-locator.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	792 B 1 KB	707ms 694ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/partner-locator.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 551da3e043dae7e65f1280d468e7a95f4a79ba33ed94f5ddf87299e8cd3710d7 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:24:45 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=154, origin; dur=219 vary Accept-Encoding content-length 792 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	partner-program-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	1 KB 984 B	361ms 348ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/partner-program-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 4fde9dfa073533f751ba920b1ce1ab850453f71d885a047621962744646b7a0e Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 628 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:26:21 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	msp-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	1 KB 886 B	361ms 349ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/msp-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 3744f05c5a6b79c7639d7d09fd252b7d70fa00f78e6b3fc7383b50a3bfef939b Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 530 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:26:20 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	partner-training-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	623 B 1 KB	1003ms 991ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/partner-training-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 3311a1f62948e52024fd6febe2f86f3068c46061a0b31f31edd382d2e5e7d26b Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:26:19 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=152, origin; dur=482 vary Accept-Encoding content-length 623 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	sophos-news-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	499 B 952 B	802ms 790ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/sophos-news-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash f4e3f9725a29c960b593c522f34dbf19ce17c3e4f68b09b78962af6ef42d095c Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:02:39 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=188, origin; dur=235 vary Accept-Encoding content-length 499 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	become-partner-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	1 KB 875 B	396ms 384ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/become-partner-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 75aad38bdf8d17c1f37460b7a23ae4ec25840e66d3d2a6f87d035ccfc213b3d8 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 518 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 27 Jun 2019 09:19:38 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	oem-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	3 KB 2 KB	396ms 385ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/oem-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash a794609e869a07403f4b45053e66d3416c7464c3783daa05e4aad1ca7c9f538f Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1342 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 09 Jul 2019 06:31:36 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	cloud-security-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	555 B 1008 B	821ms 810ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/cloud-security-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash e3de75b59dcfb5c689173d9e00e07e7d9ca65970d555c14d78ae30b6bb68f2dc Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:26:19 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=172, origin; dur=237 vary Accept-Encoding content-length 555 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	support-plans.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	897 B 1 KB	819ms 808ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/support-plans.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 459bd8c5b181784da7bba0cb70c4e73d3df3928da28a3bdf4bca772002bb0918 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Jan 2019 09:35:05 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=167, origin; dur=230 vary Accept-Encoding content-length 897 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	community-forums.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	1 KB 986 B	438ms 427ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/community-forums.svg?&w=69&la=en&hash=87317ACDB2E200802674D60E59B6609288CC5C0A Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 224121ad55637db265cbfb0c58d58fc3460de7e696900e32f3fd7ee4f42292b0 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 630 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Jan 2019 08:36:38 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	support-overview.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	429 B 882 B	899ms 888ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/support-overview.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 934e903431d01703ac77b2107753c8c118eaec0a0bda8e08da7b9ff425386141 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Jan 2019 08:36:41 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=200, origin; dur=262 vary Accept-Encoding content-length 429 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	contact-support.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	480 B 933 B	835ms 824ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/contact-support.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 0633dd0ff9496b77a3dd9ebb272b7aff0b46cd1270c8fe50a6a9f2aabe34fa2e Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Mon, 06 May 2019 12:01:43 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=162, origin; dur=227 vary Accept-Encoding content-length 480 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	downloads-updates.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	388 B 841 B	939ms 929ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/downloads-updates.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash ba2395a34fd53cc61077f6c165ccb06cb05c78d6d819b07d52cfa34d1e6ba7eb Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Jan 2019 08:36:40 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=238, origin; dur=246 vary Accept-Encoding content-length 388 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	professional-services-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	589 B 1 KB	844ms 834ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/professional-services-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash d10e8385bbab5c1f49cd9a22d93dbd4be88cba36095b7f489f90785b7de42b1e Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 12:44:58 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=157, origin; dur=224 vary Accept-Encoding content-length 589 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	documentation.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	334 B 787 B	858ms 848ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/documentation.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 4654b3e389711e378964465cf4e1f1e6728f41bb5d52bfc9b4016172ba220254 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 04 Jan 2019 08:36:39 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=155, origin; dur=231 vary Accept-Encoding content-length 334 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	about-sophos-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	792 B 1 KB	923ms 912ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/about-sophos-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash e0bfceff8ce4e12e3ee8ae01d2d186690f65a3fa8fa74cd6e245a2cb7f9aeae8 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:02:23 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=176, origin; dur=265 vary Accept-Encoding content-length 792 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	labs-graph-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	1020 B 1 KB	891ms 880ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/labs-graph-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 8244ac3bd56d80860b855d48b28505794de9aa5046edfdfd1307c4923ab428aa Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 03 May 2019 06:27:54 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=168, origin; dur=232 vary Accept-Encoding content-length 1020 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	press-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	724 B 1 KB	934ms 924ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/press-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash c5923a82c7001e5a628d224c8ed74841efbcd9e34457b37eb1b3f185d1493fa8 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:02:23 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=156, origin; dur=278 vary Accept-Encoding content-length 724 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	social-media-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	782 B 1 KB	947ms 937ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/social-media-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 328bc505a43e405732530805b3ecc7bfe5a37032381520471c94ac05a8bcc836 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:02:24 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=200, origin; dur=238 vary Accept-Encoding content-length 782 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	upcoming-events-icon.svg www.sophos.com/en-us/medialibrary/	933 B 1 KB	945ms 935ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/upcoming-events-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash c46d997b6601b673a28e2867f636352950096d12296d238450a8905ed278abdc Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 10:35:07 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=163, origin; dur=264 vary Accept-Encoding content-length 933 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	careers-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	836 B 1 KB	956ms 946ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/careers-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 9d1679bae258c2e4c6df473734b8c7d6ff7b88f6ff0d025491549debe470b81d Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:02:23 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=154, origin; dur=274 vary Accept-Encoding content-length 836 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	contact-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/	373 B 826 B	1002ms 992ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Main/contact-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash ca06e4301924022bde61deb625278e6ebbe56b9117291d804c05e1e565c0a4c4 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Wed, 02 Jan 2019 11:02:23 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=241, origin; dur=224 vary Accept-Encoding content-length 373 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	icon-central-promo.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/	4 KB 2 KB	553ms 543ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/icon-central-promo.svg?&w=25&la=en&hash=63DDF556F44C662B300BF707497F5964AD2F338E Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash c07009d0139c94a553a9e6bd71132e08ca8eeb26530ff3aef0ab984a67930dea Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1712 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 13 Feb 2019 17:38:37 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	icon-sophos-home.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/	2 KB 1 KB	553ms 544ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/icon-sophos-home.svg?&w=25&la=en&hash=0E55EC7F3EC354E1E7C3BEA0526E2F358DA4E0DB Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 7d0c9f110342b02e754d9b41b84debcf259b696b3a76a73746238c52e0ac058f Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 875 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Wed, 13 Feb 2019 17:29:23 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	icon-support.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/	506 B 959 B	999ms 989ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/icon-support.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 7911912de0a1480725dc521679a02e4c8d15c25e5aa9400b3fa5350a0a21e1bf Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 13 Nov 2018 09:02:26 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=191, origin; dur=244 vary Accept-Encoding content-length 506 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	icon-partner-portal.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/	2 KB 1 KB	573ms 564ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/icon-partner-portal.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash d751286c86a1f5bda2dc4f742a67c4995ed15c8f4c1545b8ba516c00d22b2266 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 926 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 13 Nov 2018 09:02:22 GMT x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=248 expires Wed, 07 Oct 2020 21:36:09 GMT
GET H2	200	icon-licensing-portal.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/	437 B 890 B	1137ms 1128ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Sign-In/icon-licensing-portal.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 3b8991d5abfbe01b5d18c95f030ada28089eae669397a3188b49a5ae1c3209cb Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 13 Nov 2018 09:02:19 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=231, origin; dur=323 vary Accept-Encoding content-length 437 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	free-security-tools-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	318 B 771 B	988ms 980ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/free-security-tools-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 424d8695b8e6856eaa99a7f9c94e473ab15214743a834618b995eed3072f1412 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 Apr 2019 09:51:36 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=164, origin; dur=231 vary Accept-Encoding content-length 318 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	product-demos-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/	441 B 894 B	1019ms 1010ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/EvolvedNavigation/product-demos-icon.svg?la=en Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 80a638c523a746b040dff186ec1dd3b6d84eca78b2c4c26587db7ab96d8315a5 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 16 Apr 2019 09:51:36 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=165, origin; dur=254 vary Accept-Encoding content-length 441 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	ithreat1.gif www.sophos.com/en-us/medialibrary/Images/Content/Threat-Center/Threat-Levels/	388 B 837 B	829ms 821ms	Image image/gif	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/Images/Content/Threat-Center/Threat-Levels/ithreat1.gif?h=14&&w=175&la=en&hash=102ED5BEB7F28D7E5D5F241E3365A79E9E90C7E8 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash f4d2ded74dc0c44de5d0f39f567cd0576d011f9924150530b4cb8c459c3c9f55 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 05 Apr 2011 15:39:54 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/gif status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=121, origin; dur=101 vary Accept-Encoding content-length 388 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	promoicondl_small.gif www.sophos.com/en-us/medialibrary/Images/Common/	1 KB 1 KB	626ms 618ms	Image image/gif	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/Images/Common/promoicondl_small.gif?w=17&h=16&as=1&hash=958821FEAC81A4EE3A67A347E9A97BC5C73E6116 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 632c55966e23462867a7804060857901969e5613adfde633e91e5557d4539956 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Fri, 31 Aug 2012 18:44:38 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/gif status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1049 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	download25x25.gif www.sophos.com/en-us/medialibrary/Images/Common/	1 KB 2 KB	627ms 619ms	Image image/gif	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/Images/Common/download25x25.gif?w=25&h=25&as=1&hash=783867BAA9398AC9B1900EBCDD6DA463D2BE7D06 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 1fd7dd180ba5bff6e2fc533346f450838c1f05aea5bc95b009f73d2b10ad989e Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Mon, 08 Jul 2013 14:21:11 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/gif status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1357 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	119 KB 37 KB	38ms 30ms	Script application/javascript	2a00:1450:4001:815::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0ee136766345a50c88d30b0aab77ff77ed91de0936a991abe637ed0c09134b9a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:00 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 38080 x-xss-protection 0 last-modified Wed, 07 Oct 2020 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 07 Oct 2020 21:32:00 GMT
GET H/1.1	200 OK	elqCfg.min.js Show response img03.en25.com/i/	6 KB 3 KB	113ms 37ms	Script application/x-javascript	95.100.78.166 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img03.en25.com/i/elqCfg.min.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.78.166 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-78-166.deploy.static.akamaitechnologies.com Software / Resource Hash 6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 2115 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Fri, 17 Jul 2020 18:55:09 GMT Date Wed, 07 Oct 2020 21:32:00 GMT Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-cache, no-store ETag "8bc15cb6b5cd61:0" Accept-Ranges bytes Expires Wed, 07 Oct 2020 21:32:00 GMT
GET H2	200	w7p4sauc2iyi.js Show response js.driftt.com/include/1602106500000/	137 KB 45 KB	214ms 144ms	Script application/javascript	13.224.193.80 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1602106500000/w7p4sauc2iyi.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.193.80 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-193-80.fra2.r.cloudfront.net Software nginx / Resource Hash 7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip etag "a48548cec5608126b24de4cbfe9bfb8d" x-amz-cf-pop FRA2-C1 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront status 200 access-control-allow-origin * last-modified Mon, 05 Oct 2020 17:21:34 GMT server nginx date Wed, 07 Oct 2020 21:32:00 GMT vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 via 1.1 e86025dac63232624d2273c5fd256ce4.cloudfront.net (CloudFront) cache-control max-age=10 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id gmwBBjLdlgx--ve48fEQ-RPJlOF2Wtlmeci0_qzipnpt3qCqEd_eVQ==
GET H2	200	dc.js Show response stats.g.doubleclick.net/	45 KB 17 KB	22ms 14ms	Script text/javascript	2a00:1450:400c:c06::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/dc.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 09 Sep 2020 01:50:37 GMT server Golfe2 age 1883 date Wed, 07 Oct 2020 21:00:37 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17093 expires Wed, 07 Oct 2020 23:00:37 GMT
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	4 KB 2 KB	139ms 49ms	Script application/javascript	34.96.102.137 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=25349&u=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&f=1&r=0.5386715743467241 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 , United States, ASN15169 (GOOGLE, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 2378968d86fa8d97b44ff540eac51d803e2bb7806200a548f7072190bec5ac1c Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:00 GMT content-encoding gzip server gfra1 content-type application/javascript; charset=UTF-8 status 200 timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" via 1.1 google
GET H2	200	98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4 Show response s.go-mpulse.net/boomerang/ Frame 2A92	202 KB 51 KB	32ms 8ms	Script application/javascript	2a02:26f0:6c00:291::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://s.go-mpulse.net/boomerang/98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:291::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:00 GMT content-encoding br last-modified Wed, 19 Aug 2020 01:39:43 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 status 200 cache-control max-age=604800 timing-allow-origin * content-length 51580
GET H2	200	SophosSans-Light-woff2.woff2 www.sophos.com/medialibrary/Files/Fonts/	25 KB 25 KB	40ms 33ms	Font application/font-woff2	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/medialibrary/Files/Fonts/SophosSans-Light-woff2.woff2 Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Global.css?v=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.sophos.com Referer https://www.sophos.com/Styles/Bundles/Global.css?v=7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 25316 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Oct 2019 13:28:18 GMT date Wed, 07 Oct 2020 21:32:00 GMT x-frame-options SAMEORIGIN access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin https://www.sophos.com cache-control private, max-age=300 access-control-allow-headers * expires Wed, 07 Oct 2020 21:37:00 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1390821283&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=610981894.1602106321&jid=350172746&_v=5.7.2dc&z=1390821283 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=610981894.1602106321&jid=350172746&_v=5.7.2dc&z=1390821283&slf_rd=1&random=815133193	42 B 106 B	19ms 19ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=610981894.1602106321&jid=350172746&_v=5.7.2dc&z=1390821283&slf_rd=1&random=815133193 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=610981894.1602106321&jid=350172746&_v=5.7.2dc&z=1390821283&slf_rd=1&random=815133193 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=1600747181&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=610981894.1602106321&jid=1529099834&_v=5.7.2dc&z=1600747181 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=610981894.1602106321&jid=1529099834&_v=5.7.2dc&z=1600747181&slf_rd=1&random=518497094	42 B 106 B	20ms 20ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=610981894.1602106321&jid=1529099834&_v=5.7.2dc&z=1600747181&slf_rd=1&random=518497094 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=610981894.1602106321&jid=1529099834&_v=5.7.2dc&z=1600747181&slf_rd=1&random=518497094 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	header-arrow-white.svg www.sophos.com/medialibrary/SophosNext/Images/EvolvedNavigation/	343 B 719 B	858ms 857ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/medialibrary/SophosNext/Images/EvolvedNavigation/header-arrow-white.svg Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Global.css?v=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 2a42c163168d9461b0bc20b3e9a1a10181ecb9f7c3d1b738903a7ee03ec36aa0 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/Styles/Bundles/Global.css?v=7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Mon, 15 Apr 2019 10:19:19 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=144, origin; dur=213 vary Accept-Encoding content-length 343 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	more-tools-menu.png www.sophos.com/medialibrary/SophosNext/Images/EvolvedNavigation/	133 B 505 B	732ms 732ms	Image image/png	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/medialibrary/SophosNext/Images/EvolvedNavigation/more-tools-menu.png Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Global.css?v=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 3838bded9da693158c22414a6381520ec08a5c64ff71dc48a5e390ab06b2dbe3 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/Styles/Bundles/Global.css?v=7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 19 Mar 2019 10:01:51 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/png status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=104, origin; dur=119 vary Accept-Encoding content-length 133 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	line-marquee-full3.png www.sophos.com/fairfax/media/images/	1 KB 1 KB	521ms 521ms	Image image/png	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/fairfax/media/images/line-marquee-full3.png Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Legacy.css?v=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 0c4272265b7ddaa6577a2287ce5c13be78cf6d89928dda95284527224a387b0c Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/Styles/Bundles/Legacy.css?v=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 08 Sep 2020 08:24:50 GMT etag "075f384b985d61:0" x-frame-options SAMEORIGIN content-type image/png status 200 x-xss-protection 1; mode=block cache-control max-age=7200 date Wed, 07 Oct 2020 21:32:01 GMT server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes content-length 1054 x-content-type-options nosniff x-ua-compatible IE=edge
GET H2	200	footer-down-arrow-grey.svg www.sophos.com/medialibrary/SophosNext/Images/Navigation/Footer/	302 B 677 B	999ms 999ms	Image image/svg+xml	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/medialibrary/SophosNext/Images/Navigation/Footer/footer-down-arrow-grey.svg Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Global.css?v=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 31037d926621b0758c70fb400f05cd1bf962bceddd00aae8f9c9d3551858f65c Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/Styles/Bundles/Global.css?v=7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 27 Nov 2018 14:55:13 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/svg+xml status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=MISS, edge; dur=244, origin; dur=234 vary Accept-Encoding content-length 302 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	735D3D2CB1D74CA185D9438103FF763D.ashx www.sophos.com/medialibrary/	26 KB 26 KB	528ms 528ms	Font application/font-woff2	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/medialibrary/735D3D2CB1D74CA185D9438103FF763D.ashx Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Legacy.css?v=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.sophos.com Referer https://www.sophos.com/Styles/Bundles/Legacy.css?v=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 26532 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Oct 2019 13:33:58 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin https://www.sophos.com cache-control private, max-age=300 access-control-allow-headers * expires Wed, 07 Oct 2020 21:37:01 GMT
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 586f876503ed4dc63c6ff8567b67dfeb1c84723ef5c7cf218a8ed74ccba6e1ab Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	157 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	geoiphandler.axd Show response www.sophos.com/	85 B 760 B	576ms 576ms	XHR text/plain	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/geoiphandler.axd Requested by Host: www.sophos.com URL: https://www.sophos.com/scripts/bundles/global.js?v=5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 856ff4f2c45f6ea6390dd3d33cd2efa382a18b7854ba44eb54cfa2763fcf4860 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 x-content-type-options nosniff status 200 server-timing cdn-cache; desc=MISS, edge; dur=91, origin; dur=78 content-length 85 x-xss-protection 1; mode=block x-ua-compatible IE=edge pragma no-cache referrer-policy strict-origin-when-cross-origin x-frame-options SAMEORIGIN date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding content-type text/plain; charset=utf-8 access-control-allow-origin * cache-control max-age=0, no-cache, no-store expires Wed, 07 Oct 2020 21:32:01 GMT
GET H/1.1	200 OK	svrGP.aspx s1777052651.t.eloqua.com/visitor/v200/ Redirect Chain https://s1777052651.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1777052651&ref2=elqNone&tzo=-60&ms=967&optin=disabled https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=-60&ms=967&optin=disabled&elqCookie=1	49 B 406 B	240ms 240ms	Image image/gif	141.145.8.13 ORCL-AM-OPC1
General Check archive.org Show headers Download Go to Show image Full URL https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=-60&ms=967&optin=disabled&elqCookie=1 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 141.145.8.13 Amsterdam, Netherlands, ASN43898 (ORCL-AM-OPC1, NL), Reverse DNS Software / Resource Hash f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab Security Headers Name Value Strict-Transport-Security max-age=31536000; X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; X-Content-Type-Options nosniff Date Wed, 07 Oct 2020 21:32:00 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Cache-Control private,no-cache, no-store Content-Type image/gif Content-Length 49 X-XSS-Protection 1; mode=block Expires -1 Redirect headers Pragma no-cache Strict-Transport-Security max-age=31536000; X-Content-Type-Options nosniff Date Wed, 07 Oct 2020 21:32:00 GMT P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Location https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=-60&ms=967&optin=disabled&elqCookie=1 Cache-Control private,no-cache, no-store Content-Type text/html; charset=utf-8 Content-Length 276 X-XSS-Protection 1; mode=block Expires -1
GET H3-Q050	200	va-0ca7acdf418d8c12f3819dda65c35024.js Show response dev.visualwebsiteoptimizer.com/7.0/	203 KB 58 KB	85ms 49ms	Script text/javascript	34.96.102.137 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/7.0/va-0ca7acdf418d8c12f3819dda65c35024.js Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/j.php?a=25349&u=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&f=1&r=0.5386715743467241 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 34.96.102.137 , United States, ASN15169 (GOOGLE, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash d948898fd2b414fb687c3e21d364134b0cde69557972bac45f93440feddf3412 Request headers Origin https://www.sophos.com Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:00 GMT content-encoding br last-modified Wed, 07 Oct 2020 04:12:14 GMT server gfra1 status 200 etag "5f7d401e-e859" vary Accept-Encoding, User-Agent content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=604800 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 59481 via 1.1 google
GET H3-Q050	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 301 B	165ms 135ms	Image image/gif	34.96.102.137 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=25349&d=sophos.com&u=D4C71345D0CB6E598A332232060842482&h=9627632b4818a570d5cc04c7c0aa41cd&t=false&r=0.21482914875017922 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 34.96.102.137 , United States, ASN15169 (GOOGLE, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif status 200 cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H3-Q050	200	activityi;dc_pre=CIfJpJG3o-wCFcHGuwgdx_oOkA;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2F... 9816844.fls.doubleclick.net/ Frame ADF5 Redirect Chain https://9816844.fls.doubleclick.net/activityi;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%... https://9816844.fls.doubleclick.net/activityi;dc_pre=CIfJpJG3o-wCFcHGuwgdx_oOkA;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.s...	0 0	89ms 50ms	Document text/html	216.58.207.38 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://9816844.fls.doubleclick.net/activityi;dc_pre=CIfJpJG3o-wCFcHGuwgdx_oOkA;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx? Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s24-in-f6.1e100.net Software cafe / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=21600 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 9816844.fls.doubleclick.net :scheme https :path /activityi;dc_pre=CIfJpJG3o-wCFcHGuwgdx_oOkA;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx? pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.sophos.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer about:blank Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * date Wed, 07 Oct 2020 21:32:01 GMT expires Fri, 01 Jan 1990 00:00:00 GMT cache-control no-cache, must-revalidate strict-transport-security max-age=21600 content-type text/html; charset=UTF-8 pragma no-cache x-content-type-options nosniff content-encoding gzip server cafe content-length 449 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Wed, 07-Oct-2020 21:47:01 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Redirect headers status 302 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * date Wed, 07 Oct 2020 21:32:01 GMT pragma no-cache expires Fri, 01 Jan 1990 00:00:00 GMT cache-control no-cache, must-revalidate follow-only-when-prerender-shown 1 strict-transport-security max-age=21600 location https://9816844.fls.doubleclick.net/activityi;dc_pre=CIfJpJG3o-wCFcHGuwgdx_oOkA;src=9816844;type=pagev0;cat=pageurl0;ord=3988160215568;gtm=2wg9n1;auiddc=2055256037.1602106321;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx? content-type text/html; charset=UTF-8 x-content-type-options nosniff server cafe content-length 0 x-xss-protection 0 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	siteanalyze_6025286.js Show response siteimproveanalytics.com/js/	38 KB 10 KB	14ms 10ms	Script application/javascript	2606:4700:e2::ac40:8b05 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://siteimproveanalytics.com/js/siteanalyze_6025286.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8b05 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 252fef054efa8a72f8a9e53f196e13a4b1a97d5d1e4c36f68e9016e120b1b315 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:00 GMT content-encoding gzip cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 6612 cf-ray 5deabb7a3ec3c2f4-FRA status 200 content-length 10179 x-amz-id-2 wVOppAuMLE+vbvRlp1RYYDRyqdecCw2NptmhygNBNK6YdZwF53vrVqAipLH7+DKdVf1oY1+4bkY= last-modified Mon, 15 Jun 2020 22:28:53 GMT server cloudflare etag "8d6a5e0ae2f4e73d7b75ebe705496a72" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602106321"}],"group":"cf-nel","max_age":604800} x-amz-request-id AC33D6C834790E36 cache-control max-age=86400, no-transform cf-request-id 05a69380620000c2f4cc9f4200000001 accept-ranges bytes content-type application/javascript; charset=utf-8
GET H2	200	bat.js Show response bat.bing.com/	27 KB 8 KB	31ms 27ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44dd62d6a622a6198df9bfcfc1acbf414706e86c57dfc1d0f15b147fa7f25ae0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:00 GMT content-encoding gzip last-modified Wed, 30 Sep 2020 20:44:24 GMT x-msedge-ref Ref A: BB0919C80E2D451DAF22B7DFE7F7B16E Ref B: FRAEDGE1217 Ref C: 2020-10-07T21:32:00Z status 200 etag "0417b6a97d61:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 8315
GET H2	200	px.js Show response px.spiceworks.com/	21 KB 6 KB	255ms 202ms	Script text/javascript	45.60.13.212 INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://px.spiceworks.com/px.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.60.13.212 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 1e3c4bc7ee362ed689e35a784d61babdbe4aabccf89b69bda1d93abac9a1a257 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 x-iinfo 7-690560-690561 NNYN CT(44 93 0) RT(1602106320541 0) q(0 0 1 0) r(2 2) U5 date Wed, 07 Oct 2020 21:32:01 GMT content-encoding gzip x-cdn Incapsula content-type text/javascript
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	965 B 761 B	78ms 76ms	Script application/x-javascript	2a02:26f0:6c00:28c::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 07 Oct 2020 21:32:01 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=50189 Connection keep-alive Accept-Ranges bytes Content-Length 448
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	88 KB 23 KB	8ms 5ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23070 x-xss-protection 0 pragma public x-fb-debug Mb7oX9TGTm8Ap44JX+b1yJQJVzh+yTGXk35lS49v4JlUIdi3/GWJUnyFw0CqyIXlEJXnAsOLUnF4xVi1gVBqzQ== x-fb-trip-id 664085054 date Wed, 07 Oct 2020 21:32:00 GMT x-frame-options DENY content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	90 KB 36 KB	39ms 23ms	Script application/javascript	2a00:1450:4001:81f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-743773256 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d9d8b51c69775b5d974c7b0e9b62622c4283756417c7cb371d3bdc315f49838e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36635 x-xss-protection 0 last-modified Wed, 07 Oct 2020 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 07 Oct 2020 21:32:01 GMT
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	90 KB 36 KB	38ms 22ms	Script application/javascript	2a00:1450:4001:81f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-9570324 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d2f3348c0d3918b47ecb62c6923d34ccd3202ee56ca60364d4f832b6ea5f15ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36634 x-xss-protection 0 server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 07 Oct 2020 21:32:01 GMT
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	90 KB 36 KB	42ms 30ms	Script application/javascript	2a00:1450:4001:81f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-9816844 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b4b164c736e00ede7c023adb1fd17d47b0a3cd6bd4008191597e12f42ae9204a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36634 x-xss-protection 0 last-modified Wed, 07 Oct 2020 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 07 Oct 2020 21:32:01 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	90ms 28ms	Script application/javascript	151.101.112.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding gzip age 86374 x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 content-length 1958 x-served-by cache-hhn4030-HHN last-modified Mon, 10 Aug 2020 18:10:59 GMT x-timer S1602106321.075134,VS0,VE0 etag "a4cc3f907681b24a3efd540acd5d2996+gzip" vary Accept-Encoding,Host content-type application/javascript; charset=utf-8 via 1.1 varnish cache-control no-cache accept-ranges bytes
GET H2	200	qevents.js Show response a.quora.com/	39 KB 14 KB	89ms 27ms	Script text/plain	151.101.113.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://a.quora.com/qevents.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.113.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id s3LlaOWABX1LUjiLldBNr49lVAylKDRo content-encoding gzip etag "f32ebb1e93a72c0a57add6d07f688510" age 5967 x-cache HIT, HIT status 200 content-length 13681 x-amz-id-2 SoDeqcL0jXrX+t/2ANrLxe+/YVDgwSEUiTCiSWtkf3B8ELEJdNd8f8M86yhIciWgtxZz/U1w77M= x-served-by cache-bwi5132-BWI, cache-hhn4031-HHN last-modified Fri, 25 Oct 2019 19:28:38 GMT server AmazonS3 x-amz-meta-s3cmd-attrs atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou x-timer S1602106321.075535,VS0,VE0 date Wed, 07 Oct 2020 21:32:01 GMT vary Accept-Encoding x-amz-request-id BB6952F516C62E5A via 1.1 varnish, 1.1 varnish cache-control max-age=7200 accept-ranges bytes content-type text/plain x-cache-hits 1, 1339
GET H2	204	0 bat.bing.com/action/	0 93 B	31ms 30ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=26089927&Ver=2&mid=6a4fdac5-b7c1-4276-ad1e-30c0c86bec8c&sid=5c17957008e411eb9dd55f7220c43f53&vid=5c17b4e008e411eb9aa79b5bd3ccd1f9&vids=0&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&p=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&r=&lt=865&evt=pageLoad&msclkid=N&sv=1&rn=632633 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 204 pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 45EF9495CF5643D2B07480364EC1E542 Ref B: FRAEDGE1217 Ref C: 2020-10-07T21:32:01Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 93 B	28ms 28ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=79ee9fd3-d194-4bd3-98a8-666db1052963&sid=5c17957008e411eb9dd55f7220c43f53&vid=5c17b4e008e411eb9aa79b5bd3ccd1f9&vids=0&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&p=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&r=&lt=865&evt=pageLoad&msclkid=N&sv=1&rn=13392 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 204 pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: B3B85A9279A446C49E9447AF62AF88B2 Ref B: FRAEDGE1217 Ref C: 2020-10-07T21:32:01Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 93 B	28ms 28ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=25073712&Ver=2&mid=d43d49d9-4083-4975-b3d9-cae2344882ad&sid=5c17957008e411eb9dd55f7220c43f53&vid=5c17b4e008e411eb9aa79b5bd3ccd1f9&vids=0&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&p=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&r=&lt=865&evt=pageLoad&msclkid=N&sv=1&rn=40834 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 204 pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 184258E992CC4FCBBE6B0D9E15B5967F Ref B: FRAEDGE1217 Ref C: 2020-10-07T21:32:01Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 92 B	30ms 29ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=25073713&Ver=2&mid=757cfc8a-8af6-41c5-96e8-ba443616913c&sid=5c17957008e411eb9dd55f7220c43f53&vid=5c17b4e008e411eb9aa79b5bd3ccd1f9&vids=0&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&p=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&r=&lt=865&evt=pageLoad&msclkid=N&sv=1&rn=401416 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 204 pragma no-cache date Wed, 07 Oct 2020 21:32:00 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: E96778B11E30442AB45EFF2EF0367091 Ref B: FRAEDGE1217 Ref C: 2020-10-07T21:32:01Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	334990480506518 Show response connect.facebook.net/signals/config/	234 KB 68 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/334990480506518?v=2.9.27&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c5de94c6b056367f7be4f70ba24f95662ade8893c77956c87884abf8a6d1ca39 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 69873 x-xss-protection 0 pragma public x-fb-debug mtEz5SOcrWGNlWVxQY158EYqaGuKyTkDTeTmuMTjbX93+3POorh31C2d0Uq1Qh2LiAXb3XozaDrBSfeP9jJFDA== x-fb-trip-id 664085054 x-frame-options DENY date Wed, 07 Oct 2020 21:32:01 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.beta.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	28ms 28ms	Script application/x-javascript	2a02:26f0:6c00:28c::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 07 Oct 2020 21:32:01 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=47150 Connection keep-alive Accept-Ranges bytes Content-Length 1799
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	17 KB 6 KB	138ms 46ms	Script application/javascript	199.232.53.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.53.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash e88e0ed354170d8b73435fadf714ab8fff7c00b985295495d146b5eb92dc3e50 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding gzip last-modified Tue, 30 Jun 2020 17:04:46 GMT server snooserv etag "85ee817cda81317b49d1d3056f6bdf95" vary Accept-Encoding,Origin content-type application/javascript status 200 cache-control public, max-age=60 accept-ranges bytes content-length 5809 via 1.1 varnish, 1.1 varnish
GET H2	200	WuEFNglz.min.js Show response scripts.demandbase.com/	60 KB 16 KB	66ms 21ms	Script application/javascript	99.86.243.101 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/WuEFNglz.min.js Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.243.101 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-243-101.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash c41962b29c7f5a6747d94d1aba1a5023612de87897e5a35218daafe8f0b59f4e Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id aSLQtWpSJhV0oSYbyUziT9xzwpc2aU5L content-encoding gzip last-modified Thu, 03 Sep 2020 14:12:02 GMT server AmazonS3 age 193 etag "8a8057a1f6409d59f3e746f1e10db91a" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 status 200 cache-control public, max-age=3600 date Wed, 07 Oct 2020 21:30:46 GMT x-amz-cf-pop VIE50-C1 x-amz-cf-id hkpg4rMVJ11PieimBQUavWbRi405w1b-NcMoG8k003N8HaA9J65C-Q== via 1.1 a243c19b86829b9271d382d92416109c.cloudfront.net (CloudFront)
GET H2	200	adsct t.co/i/	43 B 448 B	220ms 152ms	Image image/gif	104.244.42.5 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding gzip x-content-type-options nosniff status 200, 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 118 pragma no-cache last-modified Wed, 07 Oct 2020 21:32:01 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 31d17574ed2d5a1703139564833e6e75 x-transaction 00cdfa7c00c6a541 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	pixel q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/	43 B 421 B	495ms 123ms	Image image/gif	3.223.149.183 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&tag=ViewContent&ts=1602106321145 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.223.149.183 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-223-149-183.compute-1.amazonaws.com Software nginx / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 07 Oct 2020 21:32:01 GMT Server nginx Connection keep-alive Content-Length 43 Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Q-Stat ,6ccbbf9b87a3b2cba389831d5339873b,10.0.0.134,63564,185.216.34.99,,36677001569,1,1602106321.582,0.002,,.,0,0,0.000,0.000,-,0,0,197,110,55,10,26847,,,,,,-, Content-Type image/gif
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1602106321147&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdeta... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1602106321147%26url%3Dhttps%253A%252F%252Fwww.sophos.com%252Fen-u... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1602106321147&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32%7EBrontok-AJ%2Fde...	0 40 B	114ms 114ms	Image application/javascript	2a05:f500:10:101::b93f:9105 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1602106321147&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32%7EBrontok-AJ%2Fdetailed-analysis.aspx&liSync=true Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-efr5 content-type application/javascript content-length 0 x-li-uuid u2jqATbTOxYwERs99ioAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-content-type-options nosniff linkedin-action 1 status 302 content-length 0 x-li-uuid N+Xi/TXTOxbAO4dcuCoAAA== pragma no-cache x-li-pop afd-prod-lva1 x-msedge-ref Ref A: FEE42DAB60F341D69F79C0A8376EA980 Ref B: FRAEDGE0822 Ref C: 2020-10-07T21:32:01Z x-frame-options sameorigin date Wed, 07 Oct 2020 21:32:00 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=2592000 x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1602106321147&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32%7EBrontok-AJ%2Fdetailed-analysis.aspx&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200 OK	image.aspx 6025286.global.siteimproveanalytics.io/	34 B 650 B	170ms 40ms	Image image/gif	3.126.147.197 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://6025286.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&title=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&res=1600x1200&accountid=6025286&rt=1056&prev=1602106378522&luid=b085540e-f246-373a-3a08-7e916712d280&rnd=6926 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.126.147.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-147-197.eu-central-1.compute.amazonaws.com Software / Resource Hash 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 07 Oct 2020 21:32:01 GMT Cache-Control max-age=0, no-cache="set-cookie" Expires Wed, 07 Oct 2020 21:32:01 UTC Connection keep-alive Content-Type image/gif Content-Length 34 P3p NOI OUR IND COM NAV INT
GET H3-Q050	200	settings.js Show response dev.visualwebsiteoptimizer.com/	16 KB 3 KB	55ms 55ms	Script application/javascript	34.96.102.137 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/settings.js?a=25349&settings_type=1&vn=7.0&r=0.7884683037612081 Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/7.0/va-0ca7acdf418d8c12f3819dda65c35024.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 34.96.102.137 , United States, ASN15169 (GOOGLE, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash b1bfd2696216c07caebea35c3813a70fe23d030733e9f16a4193d4d82dd5c849 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Wed, 07 Oct 2020 21:32:00 GMT content-encoding gzip server gfra1 alt-svc h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" via 1.1 google content-type application/javascript; charset=UTF-8
GET H2	200	/ www.facebook.com/tr/	44 B 258 B	6ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&rl=&if=false&ts=1602106321174&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1602106321173.903688207&it=1602106321081&coo=false&rqm=GET Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Wed, 07 Oct 2020 21:32:01 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame 2A92	607 B 880 B	263ms 262ms	XHR application/json	2a02:26f0:6c00:181::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4&d=www.sophos.com&t=5340354&v=1.632.0&if=&sl=0&si=l43j5cre7j-qhup5d&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=&ak.ai=173635 Requested by Host: s.go-mpulse.net URL: https://s.go-mpulse.net/boomerang/98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:181::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 437e67a4081c36146529a9886ac58cad0750486c6f0df59932d422f2e099385d Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Wed, 07 Oct 2020 21:32:01 GMT Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 607 Content-Type application/json
GET H2	200	ip.json Show response api.company-target.com/api/v2/	422 B 926 B	143ms 75ms	XHR application/json	143.204.94.108 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&page_title=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7 Requested by Host: scripts.demandbase.com URL: https://scripts.demandbase.com/WuEFNglz.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.94.108 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-94-108.fra50.r.cloudfront.net Software nginx / Resource Hash 4bb0b52177bea5029f8ee5acad8128965ae4002935fc9d85af12a2a5e54ead00 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT identification-source CENTRAL vary Accept-Encoding, Origin x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront status 200 request-id 3b04a666-6667-4fb5-ab26-330f5fb5014e content-encoding gzip pragma no-cache access-control-allow-origin https://www.sophos.com server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 32e4d419823b7f8df8417a8b18c9602d.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id -5Vq3cEtKs1Ny3fIQG18OzUXnZT5FwBf8oD_RN9hXBH0bR1f1u3YHQ== expires Tue, 06 Oct 2020 21:32:01 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AAU0GE6-_GgAABDfNqy42Q https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAU0GE6-_GgAABDfNqy42Q&verifyHash=288bc0bae5c2069f7ae44d0100af0d986d7db093	26 B 408 B	203ms 203ms	Image image/gif	13.225.78.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAU0GE6-_GgAABDfNqy42Q&verifyHash=288bc0bae5c2069f7ae44d0100af0d986d7db093 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.225.78.109 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-109.fra2.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 07 Oct 2020 21:32:01 GMT Via 1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id d5a7c0e53f76ab0f X-Amz-Cf-Id CwhRd-sa6aH0AEb8ftPuXkyAlKES1oZyvWoJFPzpI0km8KPBP_xHHA== Redirect headers Date Wed, 07 Oct 2020 21:32:01 GMT Via 1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AAU0GE6-_GgAABDfNqy42Q&verifyHash=288bc0bae5c2069f7ae44d0100af0d986d7db093 Connection keep-alive trace-id 0be9ada62863e412 Content-Length 0 X-Amz-Cf-Id Dh9eAKvLddqUb3oasHvhqn-i_I9iEI1zZJDQZopzUX9vGIZKE0HPYA==
GET H2	200	rp.gif alb.reddit.com/	42 B 212 B	232ms 140ms	Image image/gif	199.232.53.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1602106321241&id=t2_3ktgjz9h&event=PageVisit&uuid=b7383341-4ae0-4e37-8a43-886b2e7551cc&s=UV2QiUv8ZgjiGpdmbRFSKw7SjbnH6Wnq9AsnLvRK5Mc%3D Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.53.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT via 1.1 varnish server Varnish content-type image/gif status 200 accept-ranges bytes content-length 42 retry-after 0
GET H2	200	9shj px.spiceworks.com/px/	42 B 510 B	67ms 67ms	Image image/gif	45.60.13.212 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://px.spiceworks.com/px/9shj?buster=18619&pxref=&_fpv=2.4&_fpt=2&_fp2=b6ca21534d91f677657b33d3d012efd3 Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.60.13.212 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 x-iinfo 7-690568-690561 PNNN RT(1602106320795 0) q(0 0 0 -1) r(1 1) U5 date Wed, 07 Oct 2020 21:32:01 GMT x-cdn Incapsula content-length 42 content-type image/gif
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	29 KB 12 KB	111ms 41ms	Script text/javascript	216.58.212.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS ams15s21-in-f2.1e100.net Software cafe / Resource Hash 6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:01 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 11311 x-xss-protection 0 server cafe etag 12833363978352728442 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 07 Oct 2020 21:32:01 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/	3 KB 1 KB	24ms 23ms	Script text/javascript	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1602106321433&cv=9&fst=1602106321433&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9n1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&tiba=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 8cbdcf07575a1f692a01161f51f42cfdc2b311a7bbcbc1f4ec03280ab9fff3c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:01 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1181 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/743773256/	42 B 538 B	42ms 27ms	Image image/gif	2a00:1450:4001:803::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/743773256/?random=1602106321433&cv=9&fst=1602104400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9n1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&tiba=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&async=1&fmt=3&is_vtc=1&random=3806429441&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:01 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/743773256/	42 B 538 B	43ms 29ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/743773256/?random=1602106321433&cv=9&fst=1602104400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9n1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx&tiba=Detailed%20Analysis%20-%20W32%2FBrontok-AJ%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&async=1&fmt=3&is_vtc=1&random=3806429441&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.sophos.com URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:01 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	pixel_39cb5df0 Show response www.sophos.com/akam/11/	0 542 B	34ms 34ms	XHR text/html	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/akam/11/pixel_39cb5df0 Requested by Host: www.sophos.com URL: https://www.sophos.com/akam/11/39cb5df0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Brontok-AJ/detailed-analysis.aspx User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:01 GMT content-type text/html status 200 cache-control max-age=0, no-cache server-timing cdn-cache; desc=HIT, edge; dur=2 content-length 0 expires Wed, 07 Oct 2020 21:32:01 GMT
GET H2	200	lnav-selected.png www.sophos.com/Styles/Bundles/medialibrary/SophosNext/Images/BrandGuidelines/	1 KB 1 KB	41ms 40ms	Image image/png	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/Styles/Bundles/medialibrary/SophosNext/Images/BrandGuidelines/lnav-selected.png Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Global.css?v=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash 296ef8d5eaa500fe30831c1a2720b59b5b6a722a5d7b93f283c0bdc8371ecaaf Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.sophos.com/Styles/Bundles/Global.css?v=7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 referrer-policy strict-origin-when-cross-origin last-modified Tue, 09 Oct 2018 05:58:38 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN content-type image/png status 200 x-xss-protection 1; mode=block cache-control private, max-age=300 x-ua-compatible IE=edge server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1098 x-content-type-options nosniff expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	SophosSans-Regular-woff2.woff2 www.sophos.com/medialibrary/Files/Fonts/	24 KB 25 KB	34ms 34ms	Font application/font-woff2	104.111.233.221 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.sophos.com/medialibrary/Files/Fonts/SophosSans-Regular-woff2.woff2 Requested by Host: www.sophos.com URL: https://www.sophos.com/Styles/Bundles/Global.css?v=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.233.221 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-221.deploy.static.akamaitechnologies.com Software / Resource Hash c1da7a3d76f2fd71ba637d968b49556520ee94d72a5b60a5d21f34f5e4029ec4 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.sophos.com Referer https://www.sophos.com/Styles/Bundles/Global.css?v=7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400 x-content-type-options nosniff status 200 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 25020 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Tue, 22 Oct 2019 13:45:32 GMT date Wed, 07 Oct 2020 21:32:01 GMT x-frame-options SAMEORIGIN access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin https://www.sophos.com cache-control private, max-age=300 access-control-allow-headers * expires Wed, 07 Oct 2020 21:37:01 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 650 B	230ms 159ms	Script application/javascript	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.aspx Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 21:32:02 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200, 200 OK x-twitter-response-tags BouncerCompliant strict-transport-security max-age=631138519 content-length 57 x-xss-protection 0 x-response-time 126 pragma no-cache last-modified Wed, 07 Oct 2020 21:32:02 GMT server tsa_o x-frame-options SAMEORIGIN content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 15fea3b72ce42479e0af3a114e4e7e59 x-transaction 0020f55c0084e8d2 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	index.html js.driftt.com/deploy/assets/ Frame DB60	0 0	33ms 33ms	Document text/html	13.224.193.80 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/deploy/assets/index.html Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1602106500000/w7p4sauc2iyi.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.193.80 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-193-80.fra2.r.cloudfront.net Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority js.driftt.com :scheme https :path /deploy/assets/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.sophos.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.sophos.com/ Response headers status 200 content-type text/html; charset=utf-8 content-length 894 server nginx last-modified Mon, 05 Oct 2020 17:21:34 GMT x-amz-server-side-encryption AES256 accept-ranges bytes access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains date Wed, 07 Oct 2020 21:32:01 GMT etag "f25d28353ebd5e9e72f90c6b4a90dd6b" cache-control max-age=10 x-cache Hit from cloudfront via 1.1 e86025dac63232624d2273c5fd256ce4.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id zB67sj-K2Shar9JdRKu6N6N3OYWWqJ2xuByUCKEaVNWkHsG4bzFqvA==
POST H2	204	/ 686eb51b.akstat.io/	0 201 B	309ms 300ms	Other image/gif	2a02:26f0:6c00:291::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://686eb51b.akstat.io/ Requested by Host: s.go-mpulse.net URL: https://s.go-mpulse.net/boomerang/98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:291::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Wed, 07 Oct 2020 21:32:02 GMT status 204 content-type image/gif access-control-allow-origin https://www.sophos.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true timing-allow-origin * x-xss-protection 0 expires Wed, 07 Oct 2020 21:32:02 GMT
GET H2	200	/ cx.atdmt.com/ Redirect Chain https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FW32~Brontok-AJ%2Fdetailed-analysis.asp... https://cx.atdmt.com/?c=10195433778124427995&f=AYxdTw4iMHKekY-Tlf6-wcZu4SndPBmZnOim8GUrrnWCjCMXEEJsdtd81tq4WsbZLj3ZdRKX9vexzFIHtCMgRpf7&id=334990480506518&l=3&v=0	43 B 423 B	44ms 32ms	Image image/gif	2a03:2880:f01c:8004:face:b00c:0:8c FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://cx.atdmt.com/?c=10195433778124427995&f=AYxdTw4iMHKekY-Tlf6-wcZu4SndPBmZnOim8GUrrnWCjCMXEEJsdtd81tq4WsbZLj3ZdRKX9vexzFIHtCMgRpf7&id=334990480506518&l=3&v=0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://www.sophos.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma public x-fb-debug NFKk3zwYDMZV2EqmudPGMCnob3Q4C9pfv2e1iGXLmWz1dGhUB/t68y/hIlp/tdz3rwGmZeUYbr1JRpChVHiadQ== content-encoding br x-content-type-options nosniff x-frame-options DENY date Wed, 07 Oct 2020 14:32:02 PDT vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=0 expires Wed, 07 Oct 2020 14:32:02 PDT Redirect headers pragma no-cache date Wed, 07 Oct 2020 21:32:02 GMT server proxygen-bolt status 302 content-type text/plain location https://cx.atdmt.com/?c=10195433778124427995&f=AYxdTw4iMHKekY-Tlf6-wcZu4SndPBmZnOim8GUrrnWCjCMXEEJsdtd81tq4WsbZLj3ZdRKX9vexzFIHtCMgRpf7&id=334990480506518&l=3&v=0 cache-control no-cache, no-store, must-revalidate alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 0 expires 0