www.beckershospitalreview.com Open in urlscan Pro
67.227.242.177 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Submission: On July 02 via api (July 2nd 2020, 7:08:40 am UTC) from GB

Summary HTTP 107 Redirects Links 50 Behaviour Indicators

Summary

This website contacted 42 IPs in 6 countries across 38 domains to perform 107 HTTP transactions. The main IP is 67.227.242.177, located in Lansing, United States and belongs to LIQUIDWEB, US. The main domain is www.beckershospitalreview.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 20th 2020. Valid for: 3 months.

This is the only time www.beckershospitalreview.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	67.227.242.177 67.227.242.177	32244 (LIQUIDWEB) (LIQUIDWEB)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff0b	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
4	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:b649	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.96.38 13.224.96.38	16509 (AMAZON-02) (AMAZON-02)
8	2a00:1450:400... 2a00:1450:4001:81f::2002	15169 (GOOGLE) (GOOGLE)
5	204.180.130.159 204.180.130.159	53866 (QTS-AS) (QTS-AS)
1	2606:4700::68... 2606:4700::6811:43b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2606:4700::68... 2606:4700::6810:5505	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	209.59.186.75 209.59.186.75	32244 (LIQUIDWEB) (LIQUIDWEB)
1	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY)
6	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	3.208.155.240 3.208.155.240	14618 (AMAZON-AES) (AMAZON-AES)
5	2606:4700::68... 2606:4700::6812:a813	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.64.134 151.101.64.134	54113 (FASTLY) (FASTLY)
1	50.28.99.4 50.28.99.4	53824 (LIQUIDWEB) (LIQUIDWEB)
1	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
1	204.180.130.165 204.180.130.165	53866 (QTS-AS) (QTS-AS)
1	2606:4700::68... 2606:4700::6811:d2cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700::68... 2606:4700::6812:15bf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:ebcc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 5	23.210.248.216 23.210.248.216	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15 18	52.30.34.11 52.30.34.11	16509 (AMAZON-02) (AMAZON-02)
2 2	54.93.140.209 54.93.140.209	16509 (AMAZON-02) (AMAZON-02)
1	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	23.210.249.164 23.210.249.164	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	70.42.32.127 70.42.32.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
1	151.101.13.44 151.101.13.44	54113 (FASTLY) (FASTLY)
1 2	52.29.156.222 52.29.156.222	16509 (AMAZON-02) (AMAZON-02)
1 2	18.194.163.10 18.194.163.10	16509 (AMAZON-02) (AMAZON-02)
1 2	37.252.173.62 37.252.173.62	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.107.224.119 34.107.224.119	15169 (GOOGLE) (GOOGLE)
1 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1 1	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
107	42

18 67.227.242.177 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)
PTR: host4.beckersasc.com

www.beckershospitalreview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff0b (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:b649 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.96.38 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-38.zrh50.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:81f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 204.180.130.159 (Chicago, United States)

ASN53866 (QTS-AS, US)
PTR: my.omedastaging.com

olytics.omeda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:43b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5505 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.59.186.75 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)

processor.asccommunications.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

beckershospitalreview.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.23.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.208.155.240 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-155-240.compute-1.amazonaws.com

srv-2020-07-02-07.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:a813 (United States)

ASN13335 (CLOUDFLARENET, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.64.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.28.99.4 (Phoenix, United States)

ASN53824 (LIQUIDWEB, US)
PTR: host.beckersasc.com

processor2.asccommunications.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

981227e344841d04df7457a6dd907fc5.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.180.130.165 (Chicago, United States)

ASN53866 (QTS-AS, US)

oqs.omeda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d2cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:15bf (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:ebcc (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.216 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-216.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 52.30.34.11 (Dublin, Ireland) 15 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-34-11.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.140.209 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-140-209.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.249.164 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-164.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.127 (United States) 1 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:f03d:1fa::4000 (United Kingdom) 1 redirects

ASN10310 (YAHOO-1, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.29.156.222 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-156-222.eu-central-1.compute.amazonaws.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.163.10 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-163-10.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.173.62 (Ascension Island) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.224.119 (United States)

ASN15169 (GOOGLE, US)
PTR: 119.224.107.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	adroll.com 15 redirects s.adroll.com d.adroll.com	25 KB
18	beckershospitalreview.com www.beckershospitalreview.com	216 KB
11	googlesyndication.com 981227e344841d04df7457a6dd907fc5.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	11 KB
7	doubleclick.net 1 redirects securepubads.g.doubleclick.net cm.g.doubleclick.net	102 KB
6	hubspot.com track.hubspot.com api.hubspot.com	2 KB
6	omeda.com olytics.omeda.com oqs.omeda.com	78 KB
5	disquscdn.com c.disquscdn.com	223 KB
5	twitter.com platform.twitter.com syndication.twitter.com	31 KB
4	asccommunications.com processor.asccommunications.com processor2.asccommunications.com	1 KB
4	facebook.net connect.facebook.net	228 KB
3	disqus.com beckershospitalreview.disqus.com disqus.com	29 KB
3	hsforms.com forms.hsforms.com	7 KB
3	googletagservices.com www.googletagservices.com	44 KB
2	openx.net 1 redirects us-u.openx.net	480 B
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
2	bidswitch.net 1 redirects x.bidswitch.net	1007 B
2	3lift.com 1 redirects eb2.3lift.com	737 B
2	outbrain.com 1 redirects sync.outbrain.com	830 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	yahoo.com 1 redirects ups.analytics.yahoo.com ads.yahoo.com	2 KB
2	advertising.com 2 redirects pixel.advertising.com	815 B
2	facebook.com www.facebook.com	333 B
2	google-analytics.com www.google-analytics.com	19 KB
2	parsely.com cdn.parsely.com srv-2020-07-02-07.pixel.parsely.com	18 KB
1	rlcdn.com idsync.rlcdn.com	66 B
1	taboola.com trc.taboola.com	282 B
1	pubmatic.com simage2.pubmatic.com	886 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	usemessages.com js.usemessages.com	15 KB
1	hs-banner.com js.hs-banner.com	7 KB
1	hs-scripts.com js.hs-scripts.com	883 B
1	google.com adservice.google.com	829 B
1	google.de adservice.google.de	829 B
1	hs-analytics.net js.hs-analytics.net	19 KB
1	hsforms.net js.hsforms.net	115 KB
1	linkedin.com platform.linkedin.com	55 KB
1	googletagmanager.com www.googletagmanager.com	33 KB
107	38

	Domain	Requested by
18	www.beckershospitalreview.com	www.beckershospitalreview.com
17	d.adroll.com	14 redirects
7	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
6	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
5	s.adroll.com	1 redirects www.beckershospitalreview.com s.adroll.com
5	track.hubspot.com
5	c.disquscdn.com	beckershospitalreview.disqus.com
5	olytics.omeda.com	www.beckershospitalreview.com olytics.omeda.com
4	connect.facebook.net	www.beckershospitalreview.com connect.facebook.net s.adroll.com
4	platform.twitter.com	www.beckershospitalreview.com platform.twitter.com
3	pagead2.googlesyndication.com	olytics.omeda.com securepubads.g.doubleclick.net
3	processor.asccommunications.com	www.beckershospitalreview.com
3	forms.hsforms.com	js.hsforms.net
3	www.googletagservices.com	www.beckershospitalreview.com securepubads.g.doubleclick.net olytics.omeda.com
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects
2	x.bidswitch.net	1 redirects
2	eb2.3lift.com	1 redirects
2	sync.outbrain.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	pixel.advertising.com	2 redirects
2	www.facebook.com	connect.facebook.net
2	disqus.com	beckershospitalreview.disqus.com
2	www.google-analytics.com	www.googletagmanager.com www.beckershospitalreview.com
1	cm.g.doubleclick.net	1 redirects
1	idsync.rlcdn.com
1	trc.taboola.com
1	ads.yahoo.com	1 redirects
1	simage2.pubmatic.com
1	pixel.rubiconproject.com
1	ups.analytics.yahoo.com
1	d.adroll.mgr.consensu.org	1 redirects
1	api.hubspot.com	js.usemessages.com
1	js.usemessages.com	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-scripts.com	js.hs-analytics.net
1	oqs.omeda.com	olytics.omeda.com
1	syndication.twitter.com	www.beckershospitalreview.com
1	981227e344841d04df7457a6dd907fc5.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	processor2.asccommunications.com	www.beckershospitalreview.com
1	srv-2020-07-02-07.pixel.parsely.com	www.beckershospitalreview.com
1	adservice.google.com	www.googletagservices.com
1	adservice.google.de	www.googletagservices.com
1	beckershospitalreview.disqus.com	www.beckershospitalreview.com
1	js.hs-analytics.net	www.beckershospitalreview.com
1	cdn.parsely.com	www.beckershospitalreview.com
1	js.hsforms.net	www.beckershospitalreview.com
1	platform.linkedin.com	www.beckershospitalreview.com
1	www.googletagmanager.com	www.beckershospitalreview.com
107	49

This site contains links to these domains. Also see Links.

Domain
www.beckersasc.com
www.beckersspine.com
www.beckersdental.com
twitter.com
www.linkedin.com
beckers.dragonforms.com
view.ceros.com
bit.ly
www.bbc.com
go.beckershospitalreview.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
beckershospitalreview.com cPanel, Inc. Certification Authority	`2020-06-20` - `2020-09-18`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-06-10` - `2020-09-02`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2019-10-29` - `2020-07-15`	9 months	crt.sh
platform.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-28` - `2020-09-01`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-07` - `2020-10-09`	6 months	crt.sh
*.parsely.com Amazon	`2019-08-30` - `2020-09-30`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-06-10` - `2020-09-02`	3 months	crt.sh
*.omeda.com SSL.com RSA SSL subCA	`2020-03-18` - `2020-08-28`	5 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-05-14` - `2020-08-05`	3 months	crt.sh
processor.asccommunications.com cPanel, Inc. Certification Authority	`2020-05-18` - `2020-08-16`	3 months	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
*.google.de GTS CA 1O1	`2020-06-10` - `2020-09-02`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-06-10` - `2020-09-02`	3 months	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2020-05-31` - `2020-08-29`	3 months	crt.sh
processor2.asccommunications.com Let's Encrypt Authority X3	`2020-05-23` - `2020-08-21`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-06-10` - `2020-09-02`	3 months	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2019-11-06` - `2020-12-06`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2019-10-29` - `2021-11-23`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.taboola.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2020-09-10`	3 months	crt.sh
*.3lift.com Amazon	`2019-07-17` - `2020-08-17`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh

This page contains 12 frames:

Primary Page: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Frame ID: B3607CB07EA381D9BB7B726322661F02
Requests: 96 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.c4b33f07650267db9f8a72eaac551cac.html?origin=https%3A%2F%2Fwww.beckershospitalreview.com
Frame ID: 246BCF1D0DEEE36E0FA58D1072975B2E
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.c4b33f07650267db9f8a72eaac551cac.en.html
Frame ID: 2277F2290EF9DDD1AAFFBC28C8368898
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=beckershospitalreview&t_i=167508&t_u=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t_d=%0A%09%09How%20hackers%20negotiated%20with%20UCSF%20for%20%241M%2B%20ransom%3A%205%20things%20to%20know%C2%A0%C2%A0&t_t=%0A%09%09How%20hackers%20negotiated%20with%20UCSF%20for%20%241M%2B%20ransom%3A%205%20things%20to%20know%C2%A0%C2%A0&s_o=default
Frame ID: 4AA1C403427B1A67E85F8783E28475A4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 626DBFF8DDF9EE65625B0729ED76FC1A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 2E736E6D3DA39BCF74C752148B11862E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: D6CE04BC332091FA564B2B07933E60D7
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 7B2DE44030AEE17EF49CA25D48748332
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: D9A863EA5A836213F011E8C3A6804A98
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: 7B818462E8E0026964F70AE1A52FD754
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.4/plugins/share_button.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df34a7ce350c929%26domain%3Dwww.beckershospitalreview.com%26origin%3Dhttps%253A%252F%252Fwww.beckershospitalreview.com%252Ff338db0bd2639d4%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&layout=button_count&locale=en_US&sdk=joey&size=large
Frame ID: A1ACEC579E178BE44EA33B7F974C9841
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: B8ED497955FE925FC76E239CC3D115B1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

107
Requests

100 %
HTTPS

40 %
IPv6

38
Domains

49
Subdomains

42
IPs

6
Countries

1279 kB
Transfer

3198 kB
Size

0
Cookies

50 Outgoing links

These are links going to different origins than the main page.

URL: https://www.beckersasc.com/
Title: ASC

Search URL Search Domain Scan URL

URL: https://www.beckersspine.com/
Title: Spine

Search URL Search Domain Scan URL

URL: https://www.beckersdental.com/
Title: Dental + DSO

Search URL Search Domain Scan URL

URL: https://twitter.com/beckershr

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/asc-communications/

Search URL Search Domain Scan URL

URL: https://beckers.dragonforms.com/loading.do?omedasite=BCKR_new1
Title: Sign Up For Our Free E-Newsletters

Search URL Search Domain Scan URL

URL: https://www.beckersasc.com/asc-quality-infection-control/beckers-clinical-quality-a-infection-control.html
Title: Clinical Leadership & Infection Control E-Newsletter

Search URL Search Domain Scan URL

URL: https://www.beckersasc.com/annual-ambulatory-surgery-centers-conference/
Title: Becker's ASC 27th Annual Meeting: The Business and Operations of ASCs

Search URL Search Domain Scan URL

URL: https://www.beckersasc.com/advertising-exhibiting-a-sponsorships.html
Title: Exhibiting & Sponsoring

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-gi--virtual-forum/p/1
Title: Becker's Healthcare GI Forum

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/supply-chain-leadership-virtual-event-/p/1
Title: Becker's Healthcare Supply Chain Leadership Virtual Forum

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-hr-talent-virtual-summit/p/1
Title: Becker's HR + Talent Virtual Summit

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-hit-rcm-virtual-summit/p/1
Title: Becker's Healthcare Health IT + Revenue Cycle Management Virtual Event

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-july-womens-virtual-event-4/p/1
Title: Becker's Healthcare Women's Leadership Forum

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-payer-issues-virtual-summit/p/1
Title: Becker's Healthcare Payer Issues Virtual Summit

Search URL Search Domain Scan URL

URL: http://view.ceros.com/beckers-healthcare/beckers-ceo-cfo-virtual-forum/p/1
Title: Becker's CEO + CFO Virtual Forum

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-dental-dso-august-virtual-event/p/1
Title: Becker's Dental + DSO Review Virtual Event

Search URL Search Domain Scan URL

URL: http://view.ceros.com/beckers-healthcare/beckers-oncology-virtual-forum
Title: Becker's Oncology Virtual Forum

Search URL Search Domain Scan URL

URL: http://view.ceros.com/beckers-healthcare/beckers-orthopedic-virtual-forum
Title: Becker's Orthopedics Virtual Forum

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-patient-experience-marketing/p/1
Title: Becker's Healthcare Patient Experience + Marketing Forum

Search URL Search Domain Scan URL

URL: http://view.ceros.com/beckers-healthcare/beckers-clinical-leadership-virtual-event
Title: Becker's Clinical Leadership Virtual Event

Search URL Search Domain Scan URL

URL: https://view.ceros.com/beckers-healthcare/beckers-cardiology-virtual-forum
Title: Becker's Healthcare Cardiology Virtual Forum

Search URL Search Domain Scan URL

URL: http://view.ceros.com/beckers-healthcare/beckers-pharmacy-virtual-event/p/1
Title: Becker's Pharmacy Virtual Event

Search URL Search Domain Scan URL

URL: http://view.ceros.com/beckers-healthcare/intuitive-executive-education
Title: Robotics Content Hub

Search URL Search Domain Scan URL

URL: https://bit.ly/2X4DYkH

Search URL Search Domain Scan URL

URL: https://www.bbc.com/news/technology-53214783
Title: BBC News

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/return-to-elective-care-strategies-for-post-pandemic-care-where-remote-is-the-new-normal?utm_campaign=Force_Therapeutics_WP_May_2020&utm_source=website&utm_content=recommended
Title: Return to elective care: Strategies for post-pandemic care where remote is the new normal

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/second-wave-preparedness-infection-preventionists-and-pharmacy-leaders-discuss-patient-safety-and-covid-19?utm_campaign=VigiLanz_Webinar_7.8.2020&utm_source=website&utm_content=featured
Title: Second wave preparedness: Infection preventionists and pharmacy leaders discuss patient safety and COVID-19

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/free-apis-for-cms-interoperability-compliance?utm_campaign=Change_Healthcare_Webinar_7.9.2020&utm_source=website&utm_content=featured
Title: Free APIs for CMS interoperability compliance

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/embracing-the-covid-19-disruption-leadership-perspectives-on-the-future-of-acute-care?utm_campaign=Vituity_Webinar_7.14.2020&utm_source=website&utm_content=featured
Title: Embracing the COVID-19 disruption: Leadership perspectives on the future of acute care

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/transforming-healthcare-in-your-community-putting-social-determinants-of-health-data-to-work?utm_campaign=TransUnion_Webinar_7.14.2020&utm_source=website&utm_content=featured
Title: Transforming Healthcare in Your Community: Putting Social Determinants of Health Data to Work

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/preparing-health-it-infrastructure-for-the-next-pandemic-and-the-future?utm_campaign=SVP_Webinar_7.14.2020&utm_source=website&utm_content=featured
Title: Preparing health IT infrastructure for the next pandemic and the future

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/preparing-to-return-to-your-dental-office-following-the-covid-19-crisis?utm_campaign=oneSOURCE_Webinar_7.15.2020&utm_source=website&utm_content=featured
Title: Preparing to return to your dental office following the COVID-19 crisis

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/emerge-even-stronger-why-now-is-the-time-for-healthcare-to-accelerate-digital-transformation?utm_campaign=Workday_Webinar_7.16.2020&utm_source=website&utm_content=featured
Title: Emerge even stronger: Why now is the time for healthcare to accelerate digital transformation

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/be-prepared-for-radical-shifts-in-the-revenue-cycle-as-patient-volumes-return-and-jobless-rates-climb?utm_campaign=Alpha_Health_Webinar_7.16.2020&utm_source=website&utm_content=featured
Title: Be prepared for radical shifts in the revenue cycle as patient volumes return and jobless rates climb

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/cyberthreats-and-healthcare-what-hospital-leaders-can-learn-from-an-fbi-cybercrimes-expert?utm_campaign=HPE_Webinar_7.21.2020&utm_source=website&utm_content=featured
Title: Cyberthreats and healthcare — What hospital leaders can learn from an FBI cybercrimes expert

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/the-patient-financial-experience-before-during-and-after-a-pandemic?utm_campaign=CareCredit_Webinar_7.21.2020&utm_source=website&utm_content=featured
Title: The patient financial experience: Before, during and after a pandemic

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/half-of-eds-arent-fully-equipped-to-treat-emergency-pediatric-patients-6-steps-to-enhance-emergency-care-for-children?utm_campaign=TeamHealth_WP_Nov_2019&utm_source=website&utm_content=featured
Title: Half of EDs aren't fully equipped to treat emergency pediatric patients — 6 steps to enhance emergency care for children

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/5-elements-of-a-successful-ed-transformation?utm_campaign=TeamHealth_WP_September_2019&utm_source=website&utm_content=featured
Title: 5 elements of a successful ED transformation

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/firewalls-wont-fully-protect-hospital-networks-7-common-vulnerabilities?utm_campaign=HP_WP_August_2019&utm_source=website&utm_content=featured
Title: Firewalls won't fully protect hospital networks: 7 common vulnerabilities

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/the-cybersecurity-trends-health-systems-need-to-know-8-tips-to-minimize-exposure?utm_campaign=RectangleHealth_WP_August_2019&utm_source=website&utm_content=featured
Title: The cybersecurity trends health systems need to know — 8 tips to minimize exposure

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/the-internet-of-things-and-blockchain-current-and-future-real-world-opportunities-in-healthcare?utm_campaign=Oracle_WP_September_2019&utm_source=website&utm_content=featured
Title: The internet of things and blockchain — Current and future real-world opportunities in healthcare

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/how-banner-health-transforms-data-into-savings-key-learnings-from-banners-supply-chain-success?utm_campaign=Medpricer_WP_August_2019&utm_source=website&utm_content=featured
Title: How Banner Health transforms data into savings — Key learnings from Banner's supply chain success

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/embracing-the-covid-19-disruption-defining-the-future-of-hospitals?utm_campaign=vituity_wp_july_2020&utm_source=website&utm_content=featured
Title: Embracing the COVID-19 disruption: Defining the future of hospitals

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/its-time-to-reimagine-inpatient-care-the-next-generation-of-hospital-medicine?utm_campaign=scp_health_wp_july_2020&utm_source=website&utm_content=featured
Title: It's time to reimagine inpatient care: The next generation of hospital medicine

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/how-hospitals-from-london-to-new-orleans-used-their-covid-19-response-to-fuel-innovation?utm_campaign=Hyland_WP_June_2020&utm_source=website&utm_content=featured
Title: How hospitals from London to New Orleans used their COVID-19 response to fuel innovation

Search URL Search Domain Scan URL

URL: https://go.beckershospitalreview.com/the-solution-to-healthcares-most-persistent-challenges-a-smarter-workforce-strategy?utm_campaign=Vista_Staffing_WP_May_2020&utm_source=website&utm_content=featured
Title: The solution to healthcare's most persistent challenges? A smarter workforce strategy

Search URL Search Domain Scan URL

URL: https://www.beckersasc.com/june-conference/
Title: Spine, Orthopedic and Pain Management-Driven ASC + the Future of Spine Conference

Search URL Search Domain Scan URL

URL: http://www.facebook.com/pages/Beckers-Hospital-Review/101670627494

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/hospitalreview1

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 85

https://s.adroll.com/j/exp/JQYF3N5JPJGL3IXYVZYR5C/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 87

https://d.adroll.mgr.consensu.org/consent/iabcheck/JQYF3N5JPJGL3IXYVZYR5C?_s=9f2b032712d4f9292d3f86b5ff7dae34&_b=2 HTTP 302
https://d.adroll.com/consent/check/JQYF3N5JPJGL3IXYVZYR5C/?_s=9f2b032712d4f9292d3f86b5ff7dae34&_b=2

Request Chain 89

https://d.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&pv=10832779513.120472&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/E5Z5CE3QIZFWDO32KJIMW5.js

Request Chain 91

https://d.adroll.com/cm/aol/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPc858f117-bc32-11ea-8216-06fa158880c0

Request Chain 92

https://d.adroll.com/cm/index/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expiration=1625209688 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expiration=1625209688&C=1

Request Chain 93

https://d.adroll.com/cm/n/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expires=365

Request Chain 94

https://d.adroll.com/cm/outbrain/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&rdrctExp=true

Request Chain 95

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 96

https://d.adroll.com/cm/r/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 97

https://d.adroll.com/cm/taboola/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

Request Chain 98

https://d.adroll.com/cm/triplelift/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://eb2.3lift.com/xuid?mid=4714&xuid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&dongle=c85e HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

Request Chain 99

https://d.adroll.com/cm/b/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

Request Chain 100

https://d.adroll.com/cm/x/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

Request Chain 101

https://d.adroll.com/cm/l/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://idsync.rlcdn.com/377928.gif?partner_uid=71453af696a1a55fb5c935c6f6e0f6da

Request Chain 102

https://d.adroll.com/cm/o/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=71453af696a1a55fb5c935c6f6e0f6da HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=71453af696a1a55fb5c935c6f6e0f6da

Request Chain 103

https://d.adroll.com/cm/g/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&xid_ch=f&advertisable=JQYF3N5JPJGL3IXYVZYR5C&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=cUU69pahpV-1yTXG9uD22g HTTP 302
https://d.adroll.com/cm/g/in

107 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html Show response
www.beckershospitalreview.com/cybersecurity/ 86 KB
19 KB 594ms
267ms Document
text/html 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

693ed50f14a610fca6306c3824308a01782a1265d33db88fdfbd5f827e63f416

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Host: www.beckershospitalreview.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Wed, 17 Aug 2005 00:00:00 GMT
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache
X-Content-Type-Options: nosniff
Last-Modified: Thu, 02 Jul 2020 06:11:58 GMT
ETag: "da033c6ed956dd53603ed7944675a239-gzip"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000
Content-Length: 19160
Keep-Alive: timeout=2, max=500
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK content.css
www.beckershospitalreview.com/plugins/system/jce/css/ 1 KB
807 B 288ms
166ms Stylesheet
text/css 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/plugins/system/jce/css/content.css?a82d04ed3cd810b0ad7366914c5707bc

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

32d5263e5b45f74ba37bdda3e51c9023cb15c63426314e70499429f38e934ea0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 27 Dec 2019 15:00:10 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000
Content-Type: text/css
Cache-Control: max-age=1
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=499
Content-Length: 364
Expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H/1.1 200
OK olytics.css
www.beckershospitalreview.com/templates/beckers/assets/css/ 21 KB
3 KB 455ms
166ms Stylesheet
text/css 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/css/olytics.css

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

6bc3d7fe15b24b558834b79a2d083f2133d98526495c50b91ef52510ada0d9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 09 Jun 2020 22:06:08 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000
Content-Type: text/css
Cache-Control: max-age=1
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=498
Content-Length: 2584
Expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
www.beckershospitalreview.com/templates/beckers/assets/javascript/ 85 KB
30 KB 484ms
171ms Script
application/javascript 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery-3.3.1.min.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 21 Jan 2019 16:34:29 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Cache-Control: max-age=1
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=500
Content-Length: 30307
Expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H/1.1 200
OK jquery.cookie.js Show response
www.beckershospitalreview.com/templates/beckers/assets/javascript/ 3 KB
2 KB 481ms
167ms Script
application/javascript 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery.cookie.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 31 May 2018 01:41:08 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Cache-Control: max-age=1
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=500
Content-Length: 1365
Expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H/1.1 200
OK common.js Show response
www.beckershospitalreview.com/templates/beckers/assets/javascript/ 20 KB
6 KB 485ms
168ms Script
application/javascript 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/javascript/common.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

039952e79714d9dfa24a26a982f1c06ac55c0787b44a553ae0de30b259ba1fd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 27 Jun 2020 00:04:01 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Cache-Control: max-age=1
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=500
Content-Length: 5555
Expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H/1.1 200
OK master.css
www.beckershospitalreview.com/templates/beckers/assets/css/ 87 KB
9 KB 480ms
169ms Stylesheet
text/css 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/css/master.css?version=2

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

0ac4b97eca29e7638f16f7358a58f651671dab83d37beec966b72136d1d06132

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 26 Jun 2020 19:40:21 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000
Content-Type: text/css
Cache-Control: max-age=1
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=500
Content-Length: 9197
Expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 84 KB
33 KB 33ms
21ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-5366982-1

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

caf5deed16ce6f86eb324117d79198edacf2f06eb51640482caf543d05187009

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:04 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33692
x-xss-protection: 0
last-modified: Thu, 02 Jul 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Jul 2020 07:08:04 GMT

GET
H/1.1 200
OK health-it-logo.png
www.beckershospitalreview.com/templates/beckers/assets/images/ 4 KB
5 KB 166ms
163ms Image
image/png 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/images/health-it-logo.png

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

d635525e019c41dc7afd21e3dfb2e44af7b53470fd648b0b40d05ff2098fc4d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Sat, 14 Mar 2020 21:59:38 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=499
Content-Length: 4534
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H/1.1 200
OK COVID-19_Button_1.jpg
www.beckershospitalreview.com/images/site/ 12 KB
13 KB 174ms
171ms Image
image/jpeg 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/images/site/COVID-19_Button_1.jpg

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

1d7a802b8e9e175ebe671d6c3989d75576acae8fbff407650f59902cbeab3b1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Wed, 01 Apr 2020 21:39:51 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/jpeg
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=499
Content-Length: 12658
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 181 KB
55 KB 45ms
5ms Script
text/javascript 2a01:4a0:1338:28::c38a:ff0b
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff0b , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: Play /
Resource Hash: ec917df7f0b9aea1811a82316b3a91d0751cda7a6eff394cdb4feb5983a56d2b

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-LI-UUID: 3BlS5w/bHRZgDemGGisAAA==
Date: Thu, 02 Jul 2020 07:08:05 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
Server: Play
X-Li-Pop: prod-efr5
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
Connection: keep-alive
X-LI-Proto: http/1.1
Content-Length: 55596
X-CDN: AKAM
X-Li-Fabric: prod-lva1
Expires: Thu, 2 Jul 2020 07:18:24 GMT

GET
H2 200 widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 177ms
59ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 99ab6fd805e3873aa0a5adedd4b27e9c74becff9cd70b5ae1e96d420379736b0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 28903
x-served-by: cache-bwi5145-BWI, cache-hhn4075-HHN
last-modified: Tue, 30 Jun 2020 18:28:19 GMT
etag: "39da0b876a64ee1b6bc99d214750b9f3+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H/1.1 200
OK 8.jpg
www.beckershospitalreview.com/images/channels/cybersecurity/ 115 KB
116 KB 163ms
161ms Image
image/jpeg 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/images/channels/cybersecurity/8.jpg

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

f29b5a9c9a78bd710363d13f9c06afede0368f7d188fe54ab9ef16ceb6dee4d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Thu, 11 Jun 2020 20:15:08 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/jpeg
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=499
Content-Length: 117877
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 459 KB
115 KB 37ms
20ms Script
application/javascript 2606:4700::6811:b649
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b649 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a38e727a20a5bf017bfcaa514758f4dbfa319607c9e0fdf85c8113585fe3469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:04 GMT
via: 1.1 d4b41c13595dcfd327649d8cdea72ce8.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
age: 60203
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
cf-request-id: 03aff3af700000dfef43ac9200000001
last-modified: Wed, 01 Jul 2020 10:35:02 UTC
server: cloudflare
etag: W/"f3e7e5a3555af88c51fc3c609c3ebdd4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-version-id: C2snKF5eB8J1lt4Ar_kIE0gROD1tR9eU
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-amz-cf-pop: IAD89-C3
cf-ray: 5ac688924bcedfef-FRA
x-amz-cf-id: sxxB3P3fSwsPe_yeGz6JPGDW4Xozs53RnE0cfwOEj9ksReBKCAbN_w==

GET
H2 200 p.js Show response
cdn.parsely.com/keys/beckershospitalreview.com/ 45 KB
17 KB 264ms
108ms Script
application/x-javascript 13.224.96.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/beckershospitalreview.com/p.js
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.96.38 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-38.zrh50.r.cloudfront.net
Software: nginx /
Resource Hash: 16eb3771501078a5c2b3c0b1c09fd127abc7dc2e945526dce9c5ce5f3b8e8e2e

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Wed, 01 Jul 2020 10:34:24 GMT
content-encoding: gzip
last-modified: Thu, 02 Apr 2020 00:30:30 GMT
server: nginx
age: 74009
etag: W/"5e853226-b52e"
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=86400, public
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: TpyFnjg3bFTyR27m3GpHhN4CeVmyGV9K77goPhLFLnzKLqrcqSw3bg==
via: 1.1 a70d280cd058ea89c08954ea0ad67199.cloudfront.net (CloudFront)
expires: Thu, 02 Jul 2020 10:34:24 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 49 KB
17 KB 36ms
14ms Script
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b58356b9def6929c1c514b8d317d856219bfc1847759136f1f752eb5c2633976

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "558 / 425 of 1000 / last-modified: 1593628459"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 16563
x-xss-protection: 0
expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H/1.1 200 olytics.min.js Show response
olytics.omeda.com/olytics/js/v3/p/ 277 KB
77 KB 854ms
149ms Script
application/javascript 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/common.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

3b271c825996d8e6eab7c8949881ca7a51f0257210f9265c2202b0afdd446df5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 09 Jun 2020 22:06:08 GMT
Server: Apache
ETag: W/"283761-1591740368000"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=21600
Transfer-Encoding: chunked
Accept-Ranges: bytes
vary: accept-encoding
X-XSS-Protection: 1; mode=block
Expires: Thu, 02 Jul 2020 13:08:05 GMT

GET
H2 200 498900.js Show response
js.hs-analytics.net/analytics/1593673800000/ 64 KB
19 KB 37ms
15ms Script
text/javascript 2606:4700::6811:43b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1593673800000/498900.js
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:43b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e997fc603bb925233e39dc8060429dad2a486736a1b8ff32ca74d0739fc4ddbb

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
cf-cache-status: HIT
age: 41
x-amz-server-side-encryption: AES256
status: 200
x-amz-request-id: 11FF4BE9BA69A845
x-amz-id-2: tvetAmpY0TsmXotk+61Z2JNqRim8Aol3GOjq9ura9N6t/AgkXM/QD9JQ0asrPzFVNm1OnUwv3fk=
last-modified: Wed, 06 May 2020 13:24:06 GMT
server: cloudflare
etag: W/"1f358ec8f4c56be6d0b3e200e9d62707"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-request-id: 03aff3b0090000c290ea3ca200000001
cf-ray: 5ac688934c6bc290-FRA
expires: Thu, 02 Jul 2020 07:12:24 GMT

GET
H/1.1 200
OK twitter.png
www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/ 2 KB
2 KB 162ms
162ms Image
image/png 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/twitter.png

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

ee97deb871f1fdc91ff3363932be46c0fe0a3cc7e72f7d297c0fb229afd37e87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/templates/beckers/assets/css/master.css?version=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Sun, 06 Nov 2016 02:31:09 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=499
Content-Length: 1945
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H/1.1 200
OK linkedin.png
www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/ 2 KB
2 KB 167ms
167ms Image
image/png 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/linkedin.png

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

6d2d7df168329692db78d767ec9d036acf3a8c5504fbe6100b963f0dad3d5503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/templates/beckers/assets/css/master.css?version=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Sun, 06 Nov 2016 02:31:08 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=497
Content-Length: 1657
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e53ed618b330ff0bf708d79f61c38056ff1bf0e63978f017410d157d084f2016

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: up8YKAk59UimdAxFWHUNGw==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1781
etag: "72cd7718ad38e32ea9e5edd9ab7e1b6d"
x-fb-debug: nleSaJcYoZyNtgmewxDw2ltdUvs9Agty8n3qV7driDscMHATGoDZt/aGwBKJHGo/tOvhqmTo/FecKeGPUQoLVg==
x-fb-trip-id: 664085054
x-fb-content-md5: bb8006675f34aa458340a5ccfb883b64
x-frame-options: DENY
date: Thu, 02 Jul 2020 07:08:05 GMT, Thu, 02 Jul 2020 07:08:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 02 Jul 2020 07:26:50 GMT

GET
H2 200 7dcacd71-8aa3-4d69-8929-c2a110c47927 Show response
forms.hsforms.com/embed/v3/form/498900/ 2 KB
1 KB 128ms
111ms Script
application/javascript 2606:4700::6810:5505
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/498900/7dcacd71-8aa3-4d69-8929-c2a110c47927?callback=hs_reqwest_0&hutk=

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5505 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff137f1a0462e79c67dccba49c9388f797fa9accb9e7b84cd59c98e9f2aebaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
content-disposition: attachment; filename=no-rfd.txt
vary: Accept-Encoding
cf-request-id: 03aff3b04d00001f45bc812200000001
server: cloudflare
x-trace: 2B07C2E79001E010FBDA0304C9D0A62D0A9D1294D1000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript;charset=utf-8
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 5ac68893aaed1f45-FRA

GET
H2 200 f30a4301-3d92-43a0-9e22-a609707527b4 Show response
forms.hsforms.com/embed/v3/form/498900/ 6 KB
2 KB 125ms
109ms Script
application/javascript 2606:4700::6810:5505
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/498900/f30a4301-3d92-43a0-9e22-a609707527b4?callback=hs_reqwest_1&hutk=

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5505 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b8fb68e04f17e2423f4d06ce78bb08a1e6518197e5935d4a2b3c8622f3aabf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
content-disposition: attachment; filename=no-rfd.txt
vary: Accept-Encoding
cf-request-id: 03aff3b04d00001f45bc813200000001
server: cloudflare
x-trace: 2BE6EAB5ACB16010A1BE2507145FC35BFA9BA60779000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript;charset=utf-8
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 5ac68893aaef1f45-FRA

GET
H/1.1 200
OK updateHits.php Show response
www.beckershospitalreview.com/ 0
349 B 215ms
215ms XHR
text/html 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/updateHits.php?articleId=167508

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery-3.3.1.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=1
Connection: Keep-Alive
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=2, max=500
Expires: Thu, 02 Jul 2020 07:08:06 GMT

GET
H/1.1 200
OK hutk-analyze.php Show response
processor.asccommunications.com/ 0
297 B 490ms
174ms XHR
text/html 209.59.186.75
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://processor.asccommunications.com/hutk-analyze.php?hash=
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery-3.3.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.186.75 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 mod_fcgid/2.3.9 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.beckershospitalreview.com
Date: Thu, 02 Jul 2020 07:08:05 GMT
Server: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 mod_fcgid/2.3.9
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK hutk-clicks.php Show response
processor.asccommunications.com/ 0
297 B 497ms
176ms XHR
text/html 209.59.186.75
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://processor.asccommunications.com/hutk-clicks.php?hash=&referer=
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery-3.3.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.186.75 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 mod_fcgid/2.3.9 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.beckershospitalreview.com
Date: Thu, 02 Jul 2020 07:08:05 GMT
Server: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 mod_fcgid/2.3.9
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK embed.js Show response
beckershospitalreview.disqus.com/ 69 KB
23 KB 197ms
58ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://beckershospitalreview.disqus.com/embed.js

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

3b47f4abf7217d63761066ae40e2ed784b0620ba9734eaef9be8f414809a2191

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Content-Encoding: gzip
Server: openresty
Age: 1
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 22794

GET
H2 200 7dade707-1d9b-4e0e-a5af-2dde9513b5ae Show response
forms.hsforms.com/embed/v3/form/498900/ 19 KB
4 KB 112ms
111ms Script
application/javascript 2606:4700::6810:5505
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/498900/7dade707-1d9b-4e0e-a5af-2dde9513b5ae?callback=hs_reqwest_2&hutk=

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5505 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f0e97c48115dc52ee6be12bbb4a4833382e8f3b2223dd0b5c79e0e666c96a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
content-disposition: attachment; filename=no-rfd.txt
vary: Accept-Encoding
cf-request-id: 03aff3b08200001f45bc816200000001
server: cloudflare
x-trace: 2B9711E60F016CF1183D2E9A0FB61FEFFD796C4724000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript;charset=utf-8
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 5ac688940b9b1f45-FRA

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
829 B 37ms
15ms Script
application/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.beckershospitalreview.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
829 B 39ms
16ms Script
application/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.beckershospitalreview.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020070108.js Show response
securepubads.g.doubleclick.net/gpt/ 249 KB
89 KB 197ms
69ms Script
text/javascript 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

sffe /

Resource Hash

fad4503864826ee7ba5936c537cce3304a1caf98bc586b470eb3118ec3f2089f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Jul 2020 17:32:16 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90322
x-xss-protection: 0
expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 199 KB
60 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=311ad642dbe5e9433c23843479db8c8b&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4be50da9003359d0cfd4d1af3fdf31440f1ec3f59fc270c754e7ad748affdcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Origin: https://www.beckershospitalreview.com

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: MB2DR/IeyBGbPx9b9RsG9A==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 61186
etag: "4128a273aac169a220793d641697ce3e"
x-fb-debug: K34JdtJps3CiZtd75C3Bs/+jsnIVYAXkJnkOIrRSHwrIwhdK5jPT2cix/pKKyv3zslBVU8yd5YFEA0H0W+yRJA==
x-fb-trip-id: 664085054
x-fb-content-md5: b4d024a25e3d95aee25fa65cee2b0907
x-frame-options: DENY
date: Thu, 02 Jul 2020 07:08:05 GMT, Thu, 02 Jul 2020 07:08:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Fri, 02 Jul 2021 06:34:46 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 18ms
6ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-5366982-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 6748
date: Thu, 02 Jul 2020 05:15:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Thu, 02 Jul 2020 07:15:37 GMT

GET
H/1.1 200
OK rss.png
www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/ 2 KB
2 KB 168ms
166ms Image
image/png 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/rss.png

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

44333b43b6193e3b13ea2d8253464ac87b5a13b51df406a1e2f3d8498da38db0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/templates/beckers/assets/css/master.css?version=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Sun, 06 Nov 2016 02:31:09 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=498
Content-Length: 1943
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H/1.1 200
OK facebook.png
www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/ 1 KB
2 KB 165ms
163ms Image
image/png 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/facebook.png

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

6449898e8b0c4047b3ff73d3274e616acc3849f6c5fad709ffa8010f91bdb4a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/templates/beckers/assets/css/master.css?version=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Sun, 06 Nov 2016 02:31:08 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=498
Content-Length: 1518
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H/1.1 200
OK youtube.png
www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/ 2 KB
3 KB 169ms
167ms Image
image/png 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.beckershospitalreview.com/templates/beckers/assets/images/social-icons/youtube.png

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

8b85e9af1927bb7e92829d026f9f3b4854d24e6f942235e5931e390ac54a490f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/templates/beckers/assets/css/master.css?version=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Sun, 06 Nov 2016 02:31:09 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=496
Content-Length: 2272
Expires: Sat, 01 Aug 2020 07:08:05 GMT

GET
H/1.1 200
OK /
srv-2020-07-02-07.pixel.parsely.com/plogger/ 43 B
229 B 566ms
142ms Image
image/gif 3.208.155.240
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2020-07-02-07.pixel.parsely.com/plogger/?rand=1593673685181&plid=23179439&idsite=beckershospitalreview.com&url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&sref=&sts=1593673685177&slts=0&title=How+hackers+negotiated+with+UCSF+for+%241M%2B+ransom%3A+5+things+to+know%C2%A0%C2%A0&date=Thu+Jul+02+2020+09%3A08%3A05+GMT%2B0200+(Central+European+Summer+Time)&action=pageview&pvid=94708724&u=pid%3D379626cf5366538c959379f61c5c55b6
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.155.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-155-240.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 widget_iframe.c4b33f07650267db9f8a72eaac551cac.html
platform.twitter.com/widgets/ Frame 246B 0
0 58ms
58ms Document
text/html 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.c4b33f07650267db9f8a72eaac551cac.html?origin=https%3A%2F%2Fwww.beckershospitalreview.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/widget_iframe.c4b33f07650267db9f8a72eaac551cac.html?origin=https%3A%2F%2Fwww.beckershospitalreview.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
last-modified: Tue, 30 Jun 2020 18:26:55 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "9fa476ae827f556d5b037fe43632370d+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Thu, 02 Jul 2020 07:08:05 GMT
x-served-by: cache-bwi5139-BWI, cache-hhn4075-HHN
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 5825

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
196 B 13ms
13ms Image
image/gif 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=563267458&t=pageview&_s=1&dl=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&ul=en-us&de=UTF-8&dt=How%20hackers%20negotiated%20with%20UCSF%20for%20%241M%2B%20ransom%3A%205%20things%20to%20know%C2%A0%C2%A0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1841045254&gjid=757715650&cid=722890509.1593673685&tid=UA-5366982-1&_gid=1266747631.1593673685&_r=1&cd2=Cybersecurity&cd3=Health%20IT&cd4=Jackie%20Drees&gtm=2ou6o0&z=1272015205

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 button.1378e6a69a23712ca26755ee3c4084b4.js Show response
platform.twitter.com/js/ 7 KB
2 KB 58ms
58ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.1378e6a69a23712ca26755ee3c4084b4.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 01066facadb03ef32ef7506b3dcc6144c8e9da7896c3af0bac25f4b853022b9a

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 2297
x-served-by: cache-bwi5131-BWI, cache-hhn4075-HHN
last-modified: Tue, 30 Jun 2020 18:26:44 GMT
etag: "16a79eba6d08d31b4b3b907d174f7f97+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 lounge.5c5dad4ae74bbb3422efd01116dc45e6.css
c.disquscdn.com/next/embed/styles/ 0
22 KB 41ms
22ms Other
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.5c5dad4ae74bbb3422efd01116dc45e6.css

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2981865
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 22038
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Thu, 28 May 2020 18:36:12 GMT
server: cloudflare
etag: "5ed0049c-5616"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 03aff3b1c60000d6fde1092200000001
accept-ranges: bytes
cf-ray: 5ac688960f42d6fd-FRA
expires: Fri, 28 May 2021 18:50:18 GMT

GET
H2 200 common.bundle.6c1eae6bc9387c9331312cf9e26ec68e.js
c.disquscdn.com/next/embed/ 0
88 KB 35ms
16ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.6c1eae6bc9387c9331312cf9e26ec68e.js

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 37827
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 89902
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Wed, 01 Jul 2020 16:43:51 GMT
server: cloudflare
etag: "5efcbd47-15f2e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 03aff3b1c70000d6fde1093200000001
accept-ranges: bytes
cf-ray: 5ac688960f43d6fd-FRA
expires: Thu, 01 Jul 2021 18:20:20 GMT

GET
H2 200 lounge.bundle.7f8ed42388da812e66b571110fd74f8b.js
c.disquscdn.com/next/embed/ 0
112 KB 41ms
23ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.7f8ed42388da812e66b571110fd74f8b.js

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 34298
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 114633
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Wed, 01 Jul 2020 21:29:23 GMT
server: cloudflare
etag: "5efd0033-1bfc9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 03aff3b1c70000d6fde1094200000001
accept-ranges: bytes
cf-ray: 5ac688960f44d6fd-FRA
expires: Thu, 01 Jul 2021 21:36:23 GMT

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
6 KB 103ms
34ms Other
application/javascript 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:05 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 29
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 5751
X-XSS-Protection: 1; mode=block

GET
H2 200 tweet_button.c4b33f07650267db9f8a72eaac551cac.en.html
platform.twitter.com/widgets/ Frame 2277 0
0 58ms
58ms Document
text/html 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.c4b33f07650267db9f8a72eaac551cac.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/tweet_button.c4b33f07650267db9f8a72eaac551cac.en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
last-modified: Tue, 30 Jun 2020 18:26:52 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "b3b326d9f663b84a8f3c6ca3e30a769a+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Thu, 02 Jul 2020 07:08:05 GMT
x-served-by: cache-bwi5136-BWI, cache-hhn4075-HHN
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 12297

GET
H/1.1 200
OK analyze-url.php Show response
processor2.asccommunications.com/ 1 B
275 B 615ms
231ms XHR
text/html 50.28.99.4
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://processor2.asccommunications.com/analyze-url.php?url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery-3.3.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 50.28.99.4 Phoenix, United States, ASN53824 (LIQUIDWEB, US),
Reverse DNS: host.beckersasc.com
Software: Apache /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

Accept: */*
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.beckershospitalreview.com
Date: Thu, 02 Jul 2020 07:08:05 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=500
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 5 KB
3 KB 95ms
95ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2576806115982600&correlator=1143025067625407&output=ldjh&impl=fif&adsid=NT&eid=21066662%2C21065928&vrg=2020070108&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200702&iu_parts=30116360%2CHR_Cyber_Security_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&cust_params=category%3DCybersecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1593670318&dt=1593673685485&dlt=1593673684339&idt=1116&frm=20&biw=1600&bih=1200&oid=3&adxs=100&adys=188&adks=3576172898&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&dssz=46&icsg=801284096&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1019x126&msz=1019x126&ga_vid=722890509.1593673685&ga_sid=1593673685&ga_hid=563267458&fws=4&ohw=1019&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

8f3ce132667cd2153450af86d5c021c9fa3039ee291ae2dfbf385453e654e365

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2894
x-xss-protection: 0
google-lineitem-id: 5405053573
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138315431677
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
981227e344841d04df7457a6dd907fc5.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 58ms
13ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://981227e344841d04df7457a6dd907fc5.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 26ms
7ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 5 KB
3 KB 91ms
91ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2576806115982600&correlator=1143025067625407&output=ldjh&impl=fif&adsid=NT&eid=21066662%2C21065928&vrg=2020070108&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200702&iu_parts=30116360%2CHR_Cyber_Security_600x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=600x90&cust_params=category%3DCybersecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1593670318&dt=1593673685498&dlt=1593673684339&idt=1116&frm=20&biw=1600&bih=1200&oid=3&adxs=115&adys=437&adks=2641969042&ucis=2&ifi=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&dssz=46&icsg=801284096&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=950x136&msz=840x126&ga_vid=722890509.1593673685&ga_sid=1593673685&ga_hid=563267458&fws=4&ohw=840&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

a5fac8e77dfe7c3772b2a495e8f048755525a6788c713c7ab204358918edd161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2871
x-xss-protection: 0
google-lineitem-id: 5405053573
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138315028914
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 5 KB
3 KB 92ms
91ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2576806115982600&correlator=1143025067625407&output=ldjh&impl=fif&adsid=NT&eid=21066662%2C21065928&vrg=2020070108&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200702&iu_parts=30116360%2CHR_Cyber_Security_500x350&enc_prev_ius=%2F0%2F1&prev_iu_szs=500x350&cust_params=category%3DCybersecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1593670318&dt=1593673685502&dlt=1593673684339&idt=1116&frm=20&biw=1600&bih=1200&oid=3&adxs=115&adys=1970&adks=1253201176&ucis=3&ifi=3&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&dssz=46&icsg=801284096&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=965x2040&msz=700x490&ga_vid=722890509.1593673685&ga_sid=1593673685&ga_hid=563267458&fws=4&ohw=700&btvi=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

a91c605556b528777a918d826299bfa938a8a4152bc12e3f96ff0ab96de7b894

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2911
x-xss-protection: 0
google-lineitem-id: 5405053573
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138315430912
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 436 B
420 B 87ms
87ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2576806115982600&correlator=1143025067625407&output=ldjh&impl=fif&adsid=NT&eid=21066662%2C21065928&vrg=2020070108&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200702&iu_parts=30116360%2CHR_Cyber_Security_300x250v.2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cust_params=category%3DCybersecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1593670318&dt=1593673685505&dlt=1593673684339&idt=1116&frm=20&biw=1600&bih=1200&oid=3&adxs=1095&adys=435&adks=1189399999&ucis=4&ifi=4&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&dssz=46&icsg=801284096&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=390x250&msz=390x250&ga_vid=722890509.1593673685&ga_sid=1593673685&ga_hid=563267458&fws=4&ohw=1400&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

6eb65a165a487639ca9e91218beaa622edfefd016223b7c85074fc1169e4af2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 243
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 5 KB
3 KB 89ms
89ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2576806115982600&correlator=1143025067625407&output=ldjh&impl=fif&adsid=NT&eid=21066662%2C21065928&vrg=2020070108&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200702&iu_parts=30116360%2CHR_Cyber_Security_300x250&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cust_params=category%3DCybersecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1593670318&dt=1593673685509&dlt=1593673684339&idt=1116&frm=20&biw=1600&bih=1200&oid=3&adxs=1095&adys=695&adks=1719249879&ucis=5&ifi=5&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&dssz=46&icsg=801284096&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=390x250&msz=390x250&ga_vid=722890509.1593673685&ga_sid=1593673685&ga_hid=563267458&fws=4&ohw=1400&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

8e706e723ff0c54b4da2636b5468f943780e1b5e3cbf0cf7f8d8009549e5d437

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2905
x-xss-protection: 0
google-lineitem-id: 5405053573
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138315528400
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame 4AA1 0
0 186ms
186ms Document
text/html 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=beckershospitalreview&t_i=167508&t_u=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t_d=%0A%09%09How%20hackers%20negotiated%20with%20UCSF%20for%20%241M%2B%20ransom%3A%205%20things%20to%20know%C2%A0%C2%A0&t_t=%0A%09%09How%20hackers%20negotiated%20with%20UCSF%20for%20%241M%2B%20ransom%3A%205%20things%20to%20know%C2%A0%C2%A0&s_o=default

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

Connection: keep-alive
Content-Length: 2792
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Wed, 01 Jul 2020 16:44:22 GMT
ETag: W/"lounge:view:8104273674.fe47021784c73ba11ac198207f8e8f0a.2"
Content-Encoding: gzip
Date: Thu, 02 Jul 2020 07:08:05 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 626D 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 02 Jul 2020 06:52:17 GMT
expires: Fri, 02 Jul 2021 06:52:17 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 948
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17dea71c97a41e376dfb2499b46f47a7df1aa86d8cd0ceb1c137cf0373be5c2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1593430094679238"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27661
x-xss-protection: 0
expires: Thu, 02 Jul 2020 07:08:05 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 2E73 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 02 Jul 2020 06:52:17 GMT
expires: Fri, 02 Jul 2021 06:52:17 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 948
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame D6CE 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 02 Jul 2020 06:52:17 GMT
expires: Fri, 02 Jul 2021 06:52:17 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 948
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 7B2D 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 02 Jul 2020 06:52:17 GMT
expires: Fri, 02 Jul 2021 06:52:17 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 948
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
337 B 175ms
174ms Image
image/gif 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22l%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1593673685641%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%229066bb2%3A1593540614199%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Thu, 02 Jul 2020 07:08:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f99230095bfc92566df9f7e0cf6bbd36
x-transaction: 00dfedd2003502c5
expires: Tue, 31 Mar 1981 05:00:00 GMT

HEAD
H2 200 adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 0
0 92ms
20ms Fetch
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 02 Jul 2020 07:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 8588831523089118732
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 02 Jul 2020 07:08:06 GMT

POST
H/1.1 200 olytics Show response
oqs.omeda.com/oqs/rest/ 15 B
307 B 145ms
144ms XHR
application/json 204.180.130.165
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://oqs.omeda.com/oqs/rest/olytics

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.180.130.165 Chicago, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

8f78cfd70561bfbb767311940126a4ccdfe36f1b955a5fd385df8617bca6417a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Transfer-Encoding: chunked
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 F-d2fb2a5d-1d12-4364-93f4-f1119aeda8e5 Show response
olytics.omeda.com/olytics/segments/o/3c975d3141e541ff8197a5a3b2d3fde9/c/null/a/ 25 B
318 B 848ms
149ms XHR
application/json 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/segments/o/3c975d3141e541ff8197a5a3b2d3fde9/c/null/a/F-d2fb2a5d-1d12-4364-93f4-f1119aeda8e5

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

cd1707ff961932c5fe28a5722a31c9dbaad2b2e3dbc65ef5f28bcd101fbc1474

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:06 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Transfer-Encoding: chunked
X-XSS-Protection: 1; mode=block

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame D9A8 337 B
403 B 16ms
15ms Stylesheet
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 12610210
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 244
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Tue, 04 Feb 2020 01:14:10 GMT
server: cloudflare
etag: "5e38c562-f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 03aff3b5700000d6fde110b200000001
accept-ranges: bytes
cf-ray: 5ac6889bec56d6fd-FRA
expires: Thu, 04 Feb 2021 13:19:18 GMT

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 7B81 337 B
442 B 14ms
14ms Stylesheet
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: beckershospitalreview.disqus.com
URL: https://beckershospitalreview.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 12610210
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 244
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Tue, 04 Feb 2020 01:14:10 GMT
server: cloudflare
etag: "5e38c562-f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 03aff3b5750000d6fde110c200000001
accept-ranges: bytes
cf-ray: 5ac6889bec65d6fd-FRA
expires: Thu, 04 Feb 2021 13:19:18 GMT

HEAD
H2 200 gpt.js
www.googletagservices.com/tag/js/ 0
0 15ms
14ms Fetch
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "558 / 653 of 1000 / last-modified: 1593628459"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 02 Jul 2020 07:08:06 GMT

GET
H/1.1 200
OK omeda-migrate-cookies.php Show response
processor.asccommunications.com/hubspot/ 15 B
317 B 503ms
171ms XHR
text/html 209.59.186.75
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://processor.asccommunications.com/hubspot/omeda-migrate-cookies.php
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/jquery-3.3.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.186.75 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 mod_fcgid/2.3.9 /
Resource Hash: ef8d499db825c8050e64bef5cb8e084f5176acc457b48592afea62f81001e487

Request headers

Accept: */*
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.beckershospitalreview.com
Date: Thu, 02 Jul 2020 07:08:07 GMT
Server: Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 mod_fcgid/2.3.9
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK getArticleRelated.php Show response
www.beckershospitalreview.com/ 2 KB
914 B 668ms
254ms XHR
text/html 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/getArticleRelated.php?articleId=167508

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/common.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

24219edabec197505dc81a1ed1ab8397069b9457d319e99ce78bc4bd66379fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=1
Connection: Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Length: 523
Keep-Alive: timeout=2, max=500
Expires: Thu, 02 Jul 2020 07:08:08 GMT

GET
H/1.1 200
OK get-hubspot-related.php Show response
www.beckershospitalreview.com/ 383 B
663 B 702ms
250ms XHR
text/html 67.227.242.177
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.beckershospitalreview.com/get-hubspot-related.php?type=whitepaper&article-id=167508

Requested by

Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/templates/beckers/assets/javascript/common.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

67.227.242.177 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

host4.beckersasc.com

Software

Apache /

Resource Hash

c8322d2ef5133db4095a360bf3a008fbd9bcf41654afc17974f5b8146230cd02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=1
Connection: Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Length: 272
Keep-Alive: timeout=2, max=500
Expires: Thu, 02 Jul 2020 07:08:08 GMT

GET
H2 200 498900.js Show response
js.hs-scripts.com/ 1 KB
883 B 30ms
12ms Script
application/javascript 2606:4700::6811:d2cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/498900.js
Requested by: Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1593673800000/498900.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:d2cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b75bff4b2a163b9e358b67a861d63041b8b25cd9b0b98c0397a0785a9e4d98eb

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:07 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 42
cf-polished: origSize=1221
status: 200
cf-request-id: 03aff3b8dc000096e6b1964200000001
cf-bgj: minify
server: cloudflare
x-trace: 2B3A370ED45BE74444EDFA03C43307B95C46A5B214000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 5ac688a168a396e6-FRA
expires: Thu, 02 Jul 2020 07:09:07 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
529 B 43ms
23ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=498900&rcu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&pu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t=How+hackers+negotiated+with+UCSF+for+%241M%2B+ransom%3A+5+things+to+know%C2%A0%C2%A0&cts=1593673687232&vi=a34d3c0f011f9c14913c4de929d2e4a1&nc=true&ce=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5ac688a17df9d6f1-FRA
date: Thu, 02 Jul 2020 07:08:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 03aff3b8ed0000d6f1fa867200000001
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
129 B 48ms
28ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=f30a4301-3d92-43a0-9e22-a609707527b4&fci=5368b3bc-3304-4716-9ecf-9a574bb7c28f&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=498900&rcu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&pu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t=How+hackers+negotiated+with+UCSF+for+%241M%2B+ransom%3A+5+things+to+know%C2%A0%C2%A0&cts=1593673687247&vi=a34d3c0f011f9c14913c4de929d2e4a1&nc=true&ce=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5ac688a17dfad6f1-FRA
date: Thu, 02 Jul 2020 07:08:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 03aff3b8ed0000d6f1fa868200000001
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
129 B 44ms
24ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=7dcacd71-8aa3-4d69-8929-c2a110c47927&fci=3209c4b0-e233-45ef-ba40-ce6b4f58a208&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=498900&rcu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&pu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t=How+hackers+negotiated+with+UCSF+for+%241M%2B+ransom%3A+5+things+to+know%C2%A0%C2%A0&cts=1593673687250&vi=a34d3c0f011f9c14913c4de929d2e4a1&nc=true&ce=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5ac688a17dfbd6f1-FRA
date: Thu, 02 Jul 2020 07:08:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 03aff3b8ee0000d6f1fa869200000001
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
129 B 45ms
25ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=7dade707-1d9b-4e0e-a5af-2dde9513b5ae&fci=59864056-ecfb-4787-a869-e114a833ef04&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=498900&rcu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&pu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t=How+hackers+negotiated+with+UCSF+for+%241M%2B+ransom%3A+5+things+to+know%C2%A0%C2%A0&cts=1593673687251&vi=a34d3c0f011f9c14913c4de929d2e4a1&nc=true&ce=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5ac688a17dfdd6f1-FRA
date: Thu, 02 Jul 2020 07:08:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 03aff3b8ee0000d6f1fa86a200000001
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
129 B 43ms
23ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=7dade707-1d9b-4e0e-a5af-2dde9513b5ae&fci=59864056-ecfb-4787-a869-e114a833ef04&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=498900&rcu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&pu=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&t=How+hackers+negotiated+with+UCSF+for+%241M%2B+ransom%3A+5+things+to+know%C2%A0%C2%A0&cts=1593673687255&vi=a34d3c0f011f9c14913c4de929d2e4a1&nc=true&ce=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5ac688a17e00d6f1-FRA
date: Thu, 02 Jul 2020 07:08:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 03aff3b8ee0000d6f1fa86b200000001
x-robots-tag: none

GET
H2 200 share_button.php
www.facebook.com/v2.4/plugins/ Frame A1AC 0
0 84ms
55ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.4/plugins/share_button.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df34a7ce350c929%26domain%3Dwww.beckershospitalreview.com%26origin%3Dhttps%253A%252F%252Fwww.beckershospitalreview.com%252Ff338db0bd2639d4%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&layout=button_count&locale=en_US&sdk=joey&size=large

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=311ad642dbe5e9433c23843479db8c8b&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.4/plugins/share_button.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df34a7ce350c929%26domain%3Dwww.beckershospitalreview.com%26origin%3Dhttps%253A%252F%252Fwww.beckershospitalreview.com%252Ff338db0bd2639d4%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&layout=button_count&locale=en_US&sdk=joey&size=large
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
timing-allow-origin: *
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary: Accept-Encoding
x-content-type-options: nosniff
facebook-api-version: v3.0
x-xss-protection: 0
content-type: text/html; charset="utf-8"
x-fb-debug: zWfOutmV9EHrtQI1NgfhLScYSinBc1z52OpXuzYfsRxuHoWZ6AIHvrHIjU9j20mLp2SDd3EBPjr0xMfqZYveOg==
date: Thu, 02 Jul 2020 07:08:07 GMT Thu, 02 Jul 2020 07:08:07 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
6 KB 18ms
18ms XHR
application/json 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020070108&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d7595bb6f2b662c889d9f6fb7c241143065bc1c69bafd69c417e6cd6ca3a677

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 02 Jul 2020 07:08:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5663
x-xss-protection: 0

GET
H2 200 498900.js Show response
js.hs-banner.com/ 22 KB
7 KB 60ms
28ms Script
text/javascript 2606:4700::6812:15bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/498900.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498900.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fa58c2fb50e7e37ab9743b12226d1becdcbaa4af25a94acc61b79a1925f9581

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-hash: crc32c=e0F8Bw==, md5=ciTvKo4+FCxw8hh3VUb2vQ==
date: Thu, 02 Jul 2020 07:08:07 GMT
content-encoding: br
cf-cache-status: HIT
age: 42
x-guploader-uploadid: AAANsUlg6E9K2ibY-za7QWdCvNQfKf2Z9rAmjxRIYJGQWrioUEzCj7w-dPcF6auUZ68d89RU_7afOkhZAHJL1rOYcg
x-goog-storage-class: STANDARD
status: 200
access-control-max-age: 604800
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript
cf-request-id: 03aff3b92300001f254b0ed200000001
timing-allow-origin: *
last-modified: Wed, 27 May 2020 03:08:09 GMT
server: cloudflare
etag: W/"7224ef2a8e3e142c70f218775546f6bd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-goog-generation: 1590548889306595
access-control-allow-origin: https://www.beckershospitalreview.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
x-goog-stored-content-length: 22982
cf-ray: 5ac688a1da1a1f25-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Thu, 02 Jul 2020 07:12:25 GMT

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 62 KB
15 KB 84ms
19ms Script
application/javascript 2606:4700::6811:ebcc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.usemessages.com/conversations-embed.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498900.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:ebcc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f7fa9fb1ed4fbf56b40ee85781231c88a1c396dfedc8648d0c69d66c90fd34f

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:07 GMT
via: 1.1 47c0295005ec7d8570406951491004c3.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 564
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
cf-request-id: 03aff3b944000016e61192c200000001
last-modified: Wed, 01 Jul 2020 07:47:28 UTC
server: cloudflare
etag: W/"70d08f25d7bcf2b20478a34e39b7a114"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: OPy0IufTWeTtbPge.X.bLIT8y7gxs2we
cache-control: max-age=600
x-amz-cf-pop: IAD89-C3
cf-ray: 5ac688a20b4816e6-FRA
x-amz-cf-id: 3TDmu60AJKc3vZak27Ivt-U5_N-Ad88O5vAy_6-jkDsACf33uqi9Bw==

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
6 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020070108.js?21066662

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Thu, 02 Jul 2020 07:08:07 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 37 KB
12 KB 234ms
99ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.beckershospitalreview.com
URL: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 08d59945547979f3876f8a20427204b4e6b4acf78446b68abe271503dac15563

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: ZnYpdzcOpNB8OznXE9MS83InD_ISQ8.7
Content-Encoding: gzip
ETag: "9503a3a39dc1d95fb3dee4109f0f583b"
x-amz-request-id: 535EA5D5427B96DC
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 11645
x-amz-id-2: Vrf0wcIc59sG1EJV9ej61mE1FqtthovcYraS9lDe6SgoKEX/eAVBfA/q8zomGdAh9flMYtyIlKo=
Last-Modified: Wed, 01 Jul 2020 15:34:55 GMT
Server: AmazonS3
Date: Thu, 02 Jul 2020 07:08:07 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame B8ED 0
0 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Thu, 02 Jul 2020 06:52:08 GMT
expires: Fri, 02 Jul 2021 06:52:08 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 959
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 public Show response
api.hubspot.com/livechat-public/v1/message/ 353 B
580 B 120ms
120ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubspot.com/livechat-public/v1/message/public?portalId=498900&conversations-embed=static-1.6891&mobile=false&messagesUtk=c697c5e221284f0f931499ce31fb2f6e&traceId=c697c5e221284f0f931499ce31fb2f6e&hubspotUtk=a34d3c0f011f9c14913c4de929d2e4a1&__hstc=77465994.a34d3c0f011f9c14913c4de929d2e4a1.1593673687229.1593673687229.1593673687229.1&__hssc=77465994.1.1593673687230

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96f767a8476e0de5f0aa84b0b62c50a60de23aa9dc24b016ec8d7e8aa776c78d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
X-HubSpot-Messages-Uri: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html

Response headers

date: Thu, 02 Jul 2020 07:08:07 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: DYNAMIC
status: 200
content-length: 267
cf-request-id: 03aff3ba2400001f2108172200000001
server: cloudflare
x-trace: 2BEFD3ADCE226D4356964097A7E24B9E90D16CCB13000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.beckershospitalreview.com
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 5ac688a36ed61f21-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

POST
H/1.1 200 p Show response
olytics.omeda.com/olytics/segments/ 20 B
313 B 471ms
223ms XHR
application/json 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/segments/p

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

dd0103b71a9f800bf8509fb3f34f29a1af4b26a10ceef71cea5bb29ae4ea106d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Transfer-Encoding: chunked
X-XSS-Protection: 1; mode=block

POST
H/1.1 200 / Show response
olytics.omeda.com/olytics/segments/form/check/ 20 B
313 B 275ms
148ms XHR
application/json 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/segments/form/check/

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

a8e427db11a8744bebbcdfd050f7b9d0a84b5a1754d086f1787c40db21955264

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Transfer-Encoding: chunked
X-XSS-Protection: 1; mode=block

POST
H/1.1 200 cswitch Show response
olytics.omeda.com/olytics/segments/ 20 B
313 B 145ms
144ms XHR
application/json 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/segments/cswitch

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

dd0103b71a9f800bf8509fb3f34f29a1af4b26a10ceef71cea5bb29ae4ea106d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Transfer-Encoding: chunked
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/JQYF3N5JPJGL3IXYVZYR5C/index.js
https://s.adroll.com/j/exp/index.js

28 B
680 B

61ms
61ms

Script
application/javascript

23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Gq_Uupzq2k3J8S1dXTwhnfNaf5QBJsmG
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: 1E8CDE18687D291F
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 28
x-amz-id-2: 8+VCH3RvputC9Qo7rGFnl5wdJA1nM0vRKAMwsYua3+sDRyrpBBrqzUBX8DCA2tD4Xclhnp4shRc=
Last-Modified: Mon, 22 Jun 2020 19:39:19 GMT
Server: AmazonS3
Date: Thu, 02 Jul 2020 07:08:07 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Thu, 02 Jul 2020 07:08:07 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/ 0
705 B 187ms
61ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 8OCheNFn.LZ0IUWkEq4.m6MPDNUguBQt
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-request-id: F6392883574DBECB
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 0
x-amz-id-2: mslSozSUultdMywWkUim1qFcJ1xlW7HYrYQIll4ru2+mDnbB3lVlP3A/vUCN0rMjLl00AyR4bOQ=
Last-Modified: Wed, 01 Jul 2020 21:30:02 GMT
Server: AmazonS3
Date: Thu, 02 Jul 2020 07:08:07 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/JQYF3N5JPJGL3IXYVZYR5C/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/JQYF3N5JPJGL3IXYVZYR5C?_s=9f2b032712d4f9292d3f86b5ff7dae34&_b=2
https://d.adroll.com/consent/check/JQYF3N5JPJGL3IXYVZYR5C/?_s=9f2b032712d4f9292d3f86b5ff7dae34&_b=2

377 B
846 B

69ms
68ms

Script
application/javascript

52.30.34.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/JQYF3N5JPJGL3IXYVZYR5C/?_s=9f2b032712d4f9292d3f86b5ff7dae34&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.34.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-34-11.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 3d84c76ee089428dae3a8d284869bc7078765c0e98f9f40a2a7562688d457787

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:07 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: application/javascript
content-length: 377

Redirect headers

status: 302
date: Thu, 02 Jul 2020 07:08:07 GMT
server: nginx/1.16.1
content-length: 105
location: https://d.adroll.com/consent/check/JQYF3N5JPJGL3IXYVZYR5C/?_s=9f2b032712d4f9292d3f86b5ff7dae34&_b=2

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020070108&jk=2576806115982600&bg=!rq2lrbVYY4gMt2OTw0ACAAAAlVIAAAARmQGOPTB9KyQ58kGmPx8g0TjA7TX9zky0RT0j5lfR8O8HRp9lMmHZQT3zje5K_DQjr2l293cyKUax4MKeN__FQGSwdNNKnU8cjb4M5fw2j2YNr3NF1vT_-sI4Ye6eBVK290S-awr4MBPBMN-t7UeO60xfuQ_8e_ZcflxsOi0Vet9vZWMtWpDQAa8cRSlvHY24a9nLnf6tmRRQzFDkimYvUlwhUDDQh2CMF8oJQOxIAX9jmYW0TMTLl_YecFbJjuxB8tOTGVN5SUq37XSEabaHzVoxY5Er40Zhnjp0MahRmPSHZSGW86suMKhM-wDyFjLIJbFpzMjDb-jth_Sv5K1BSgAfxeRNVq9B3N1MClGPCe1ym3maSXVLio9B-hMg8f4xB1N37xu2RGAmji46rMVB9dM8lsZKmm2MEAT-oMfgjS33T4V-qs-0uEKCclVVtGjuXsZF8mERMZHYdBrp-SMJdojsuq16gl8x_1rREoyQHWi5sVwrViPXuDRZ04c3aSW0Ad1_EH7ooeC4kTwmrYo_TuU

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

E5Z5CE3QIZFWDO32KJIMW5.js Show response
s.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/
Redirect Chain

https://d.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity...
https://s.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/E5Z5CE3QIZFWDO32KJIMW5.js

4 KB
2 KB

258ms
258ms

Script
text/javascript

23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/E5Z5CE3QIZFWDO32KJIMW5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 80524c3719020adc57020e66322b6a530fae7f1e8b38dd8f69fc48034aea46bf

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 9rWiKHgDYsA_LgNxk6dCigtM4Msa1OSz
Content-Encoding: gzip
ETag: "4ee2333b438209dd12bba622e408950a"
x-amz-request-id: 82431B2DAEA4FA9D
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1433
x-amz-id-2: jk0pbzQssVnecc639OaBrC7OPZ2N7FDjAXVlWppT/AWsWbCisL+ntSTbzdXiZJkLS22wvOHHNec=
Last-Modified: Tue, 04 Feb 2020 01:44:52 GMT
Server: AmazonS3
Date: Thu, 02 Jul 2020 07:08:08 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

date: Thu, 02 Jul 2020 07:08:07 GMT
x-segment-display-name: Visitors to Unsegmented Pages
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
content-length: 0
pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.16.1
x-rule: *
x-segment-eid: E5Z5CE3QIZFWDO32KJIMW5
location: https://s.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/E5Z5CE3QIZFWDO32KJIMW5.js
cache-control: no-store, no-cache, must-revalidate
x-pixel-eid: WCNBXDE6Q5ETTM2BEJXDP7
x-segment-name: *
x-advertisable-eid: JQYF3N5JPJGL3IXYVZYR5C
x-conversion-currency

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 133 KB
33 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: s.adroll.com
URL: https://s.adroll.com/pixel/JQYF3N5JPJGL3IXYVZYR5C/WCNBXDE6Q5ETTM2BEJXDP7/E5Z5CE3QIZFWDO32KJIMW5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

73d764e56e8727bfd3de86dbe1c52f5105b4d6d0c41dbf91565e719e7cd74aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34036
x-xss-protection: 0
pragma: public
x-fb-debug: cQ1+45bIMG9OZWngKkM5S9oX+eLYUWZGxT3iqXtBIrv1sWpXQMAlqrt5rFjX72uYD6tkvORN67mvRmdqGk+EOQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 02 Jul 2020 07:08:08 GMT, Thu, 02 Jul 2020 07:08:08 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/aol/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1...
https://pixel.advertising.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://pixel.advertising.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
https://ups.analytics.yahoo.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPc858f117-bc32-11ea-8216-06...

0
977 B

167ms
56ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPc858f117-bc32-11ea-8216-06fa158880c0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:08 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Thu, 02 Jul 2020 07:08:08 GMT
location: https://ups.analytics.yahoo.com/ups/55980/sync?uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPc858f117-bc32-11ea-8216-06fa158880c0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expiration=1625209688
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expiration=1625209688&C=1

43 B
1001 B

94ms
93ms

Image
image/gif

23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expiration=1625209688&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Jul 2020 07:08:08 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 02 Jul 2020 07:08:08 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 02 Jul 2020 07:08:08 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expiration=1625209688&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Thu, 02 Jul 2020 07:08:08 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expires=365

0
239 B

261ms
71ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expires=365
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:08 GMT
server: nginx/1.16.1
status: 302
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&expires=365
cache-control: no-store, no-cache, must-revalidate
content-length: 124

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
https://sync.outbrain.com/cookie-sync?p=adroll&uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&rdrctExp=true

0
476 B

130ms
130ms

Image
text/plain

70.42.32.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&rdrctExp=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 02 Jul 2020 07:08:08 GMT
Cache-Control: no-cache
X-TraceId: d26d13ecb80c60d52aaaf5c9ef49f447
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&rdrctExp=true
Date: Thu, 02 Jul 2020 07:08:08 GMT
X-TraceId: 56a320ebb0cb7d33cb4d0055705637c7
Content-Length: 0

GET
H/1.1

200
OK

Pug
simage2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...

1 B
886 B

236ms
59ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection: close
Pragma: no-cache
Date: Thu, 02 Jul 2020 07:08:08 GMT
X-lat: Pug22050:0:808
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Content-Type: text/html; charset=utf-8
Content-Length: 1

Redirect headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:08 GMT
server: nginx/1.16.1
status: 302
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
cache-control: no-store, no-cache, must-revalidate
content-length: 220

GET
H2

200

in
d.adroll.com/cm/r/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

42 B
501 B

68ms
68ms

Image
image/gif

52.30.34.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.34.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-34-11.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:08 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42

Redirect headers

date: Thu, 02 Jul 2020 07:08:08 GMT
referrer-policy: no-referrer-when-downgrade
server: ATS
age: 0
status: 302
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

204

/
trc.taboola.com/sg/adroll-network/1/rtb-h/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-f...
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

0
282 B

189ms
67ms

Image
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 8
date: Thu, 02 Jul 2020 07:08:08 GMT
via: 1.1 varnish
server: nginx
x-timer: S1593673689.688396,VS0,VE8
x-cache: MISS
status: 204
x-cache-hits: 0
accept-ranges: bytes
x-served-by: cache-fra19178-FRA

Redirect headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:08 GMT
server: nginx/1.16.1
status: 302
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
cache-control: no-store, no-cache, must-revalidate
content-length: 111

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucs...
https://eb2.3lift.com/xuid?mid=4714&xuid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

37 B
352 B

59ms
59ms

Image
image/gif

52.29.156.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.156.222 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-156-222.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 02 Jul 2020 07:08:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

status: 302
date: Thu, 02 Jul 2020 07:08:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: /xuid?ld=1&mid=4714&xuid=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://x.bidswitch.net/sync?dsp_id=44&user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

43 B
411 B

56ms
55ms

Image
image/gif

18.194.163.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.163.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-163-10.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 02 Jul 2020 07:08:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Thu, 02 Jul 2020 07:08:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://ib.adnxs.com/setuid?entity=172&code=NzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

43 B
1 KB

53ms
53ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Jul 2020 07:08:10 GMT
X-Proxy-Origin: 165.231.142.36; 165.231.142.36; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.30:80
AN-X-Request-Uuid: 8b551397-29fb-4a10-b751-727eba7ca06c
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 02 Jul 2020 07:08:10 GMT
X-Proxy-Origin: 165.231.142.36; 165.231.142.36; 535.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.122:80
AN-X-Request-Uuid: 7a28fb88-c7b5-49af-91e5-6fc4cc433dae
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNzE0NTNhZjY5NmExYTU1ZmI1YzkzNWM2ZjZlMGY2ZGE
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

451

377928.gif
idsync.rlcdn.com/
Redirect Chain

https://d.adroll.com/cm/l/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://idsync.rlcdn.com/377928.gif?partner_uid=71453af696a1a55fb5c935c6f6e0f6da

0
66 B

230ms
159ms

Image
text/plain

34.107.224.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/377928.gif?partner_uid=71453af696a1a55fb5c935c6f6e0f6da
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.224.119 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.224.107.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 451
date: Thu, 02 Jul 2020 07:08:08 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

Redirect headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:08 GMT
server: nginx/1.16.1
status: 302
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://idsync.rlcdn.com/377928.gif?partner_uid=71453af696a1a55fb5c935c6f6e0f6da
cache-control: no-store, no-cache, must-revalidate
content-length: 86

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=71453af696a1a55fb5c935c6f6e0f6da
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=71453af696a1a55fb5c935c6f6e0f6da

43 B
180 B

65ms
64ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=71453af696a1a55fb5c935c6f6e0f6da
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.188.2 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:08 GMT
via: 1.1 google
server: OXGW/16.188.2
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Thu, 02 Jul 2020 07:08:08 GMT
via: 1.1 google
server: OXGW/16.188.2
status: 302
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=71453af696a1a55fb5c935c6f6e0f6da
alt-svc: clear
content-length: 0

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=6736c7516eb480cbb50f4b036009fcd9-1593673687840&arrfrr=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=cUU69pahpV-1yTXG9uD22g
https://d.adroll.com/cm/g/in

42 B
538 B

68ms
67ms

Image
image/gif

52.30.34.11
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.34.11 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-34-11.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:09 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Thu, 02 Jul 2020 07:08:09 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 187952941924941 Show response
connect.facebook.net/signals/config/ 521 KB
132 KB 78ms
78ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/187952941924941?v=2.9.21&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7e3694a166fabbc3027eaaf513a90febc3e8953ec7b9c8f35b8ea17a8c96a2ff

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: hpAx6i8rN/i8q33Wokr6LmKrt5jkNPuM6Vim9RazuQmynapYnk9jtQHItZBvnm45ksyAa6gVHcmy4VyiXYRPrw==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 02 Jul 2020 07:08:08 GMT, Thu, 02 Jul 2020 07:08:08 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
333 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=187952941924941&ev=PageView&dl=https%3A%2F%2Fwww.beckershospitalreview.com%2Fcybersecurity%2Fhow-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html&rl=&if=false&ts=1593673688312&cd[segment_eid]=E5Z5CE3QIZFWDO32KJIMW5&sw=1600&sh=1200&v=2.9.21&r=stable&ec=0&o=29&fbp=fb.1.1593673688311.118696423&it=1593673688199&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.beckershospitalreview.com/cybersecurity/how-hackers-negotiated-with-ucsf-for-1m-ransom-5-things-to-know.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 02 Jul 2020 07:08:08 GMT, Thu, 02 Jul 2020 07:08:08 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 02 Jul 2020 07:08:08 GMT

Verdicts & Comments Add Verdict or Comment

144 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js(Line 32) Message: olytics fire called

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

981227e344841d04df7457a6dd907fc5.safeframe.googlesyndication.com
ads.yahoo.com
adservice.google.com
adservice.google.de
api.hubspot.com
beckershospitalreview.disqus.com
c.disquscdn.com
cdn.parsely.com
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
disqus.com
dsum-sec.casalemedia.com
eb2.3lift.com
forms.hsforms.com
ib.adnxs.com
idsync.rlcdn.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsforms.net
js.usemessages.com
olytics.omeda.com
oqs.omeda.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.rubiconproject.com
platform.linkedin.com
platform.twitter.com
processor.asccommunications.com
processor2.asccommunications.com
s.adroll.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
srv-2020-07-02-07.pixel.parsely.com
sync.outbrain.com
syndication.twitter.com
tpc.googlesyndication.com
track.hubspot.com
trc.taboola.com
ups.analytics.yahoo.com
us-u.openx.net
www.beckershospitalreview.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
104.244.42.200
13.224.96.38
151.101.112.134
151.101.112.157
151.101.13.44
151.101.64.134
172.217.16.130
172.217.23.130
18.194.163.10
185.64.189.110
204.180.130.159
204.180.130.165
209.59.186.75
23.210.248.216
23.210.249.164
2606:4700::6810:5505
2606:4700::6811:43b0
2606:4700::6811:b649
2606:4700::6811:d2cc
2606:4700::6811:ebcc
2606:4700::6812:15bf
2606:4700::6812:a813
2606:4700::6813:9a53
2606:4700::6813:9b53
2a00:1288:f03d:1fa::4000
2a00:1450:4001:801::2001
2a00:1450:4001:809::2001
2a00:1450:4001:81f::2002
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a01:4a0:1338:28::c38a:ff0b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.126.56.137
3.208.155.240
34.107.224.119
34.98.64.218
37.252.173.62
50.28.99.4
52.29.156.222
52.30.34.11
54.93.140.209
67.227.242.177
69.173.144.138
70.42.32.127
01066facadb03ef32ef7506b3dcc6144c8e9da7896c3af0bac25f4b853022b9a
039952e79714d9dfa24a26a982f1c06ac55c0787b44a553ae0de30b259ba1fd5
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
08d59945547979f3876f8a20427204b4e6b4acf78446b68abe271503dac15563
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
0ac4b97eca29e7638f16f7358a58f651671dab83d37beec966b72136d1d06132
0b8fb68e04f17e2423f4d06ce78bb08a1e6518197e5935d4a2b3c8622f3aabf4
0f7fa9fb1ed4fbf56b40ee85781231c88a1c396dfedc8648d0c69d66c90fd34f
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16eb3771501078a5c2b3c0b1c09fd127abc7dc2e945526dce9c5ce5f3b8e8e2e
17dea71c97a41e376dfb2499b46f47a7df1aa86d8cd0ceb1c137cf0373be5c2d
1d7a802b8e9e175ebe671d6c3989d75576acae8fbff407650f59902cbeab3b1d
24219edabec197505dc81a1ed1ab8397069b9457d319e99ce78bc4bd66379fde
32d5263e5b45f74ba37bdda3e51c9023cb15c63426314e70499429f38e934ea0
3b271c825996d8e6eab7c8949881ca7a51f0257210f9265c2202b0afdd446df5
3b47f4abf7217d63761066ae40e2ed784b0620ba9734eaef9be8f414809a2191
3d84c76ee089428dae3a8d284869bc7078765c0e98f9f40a2a7562688d457787
44333b43b6193e3b13ea2d8253464ac87b5a13b51df406a1e2f3d8498da38db0
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4be50da9003359d0cfd4d1af3fdf31440f1ec3f59fc270c754e7ad748affdcd7
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f0e97c48115dc52ee6be12bbb4a4833382e8f3b2223dd0b5c79e0e666c96a7d
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6449898e8b0c4047b3ff73d3274e616acc3849f6c5fad709ffa8010f91bdb4a5
693ed50f14a610fca6306c3824308a01782a1265d33db88fdfbd5f827e63f416
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bc3d7fe15b24b558834b79a2d083f2133d98526495c50b91ef52510ada0d9e8
6d2d7df168329692db78d767ec9d036acf3a8c5504fbe6100b963f0dad3d5503
6eb65a165a487639ca9e91218beaa622edfefd016223b7c85074fc1169e4af2b
73d764e56e8727bfd3de86dbe1c52f5105b4d6d0c41dbf91565e719e7cd74aed
7a38e727a20a5bf017bfcaa514758f4dbfa319607c9e0fdf85c8113585fe3469
7d7595bb6f2b662c889d9f6fb7c241143065bc1c69bafd69c417e6cd6ca3a677
7e3694a166fabbc3027eaaf513a90febc3e8953ec7b9c8f35b8ea17a8c96a2ff
7fa58c2fb50e7e37ab9743b12226d1becdcbaa4af25a94acc61b79a1925f9581
80524c3719020adc57020e66322b6a530fae7f1e8b38dd8f69fc48034aea46bf
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8b85e9af1927bb7e92829d026f9f3b4854d24e6f942235e5931e390ac54a490f
8e706e723ff0c54b4da2636b5468f943780e1b5e3cbf0cf7f8d8009549e5d437
8f3ce132667cd2153450af86d5c021c9fa3039ee291ae2dfbf385453e654e365
8f78cfd70561bfbb767311940126a4ccdfe36f1b955a5fd385df8617bca6417a
96f767a8476e0de5f0aa84b0b62c50a60de23aa9dc24b016ec8d7e8aa776c78d
99ab6fd805e3873aa0a5adedd4b27e9c74becff9cd70b5ae1e96d420379736b0
a5fac8e77dfe7c3772b2a495e8f048755525a6788c713c7ab204358918edd161
a8e427db11a8744bebbcdfd050f7b9d0a84b5a1754d086f1787c40db21955264
a91c605556b528777a918d826299bfa938a8a4152bc12e3f96ff0ab96de7b894
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b58356b9def6929c1c514b8d317d856219bfc1847759136f1f752eb5c2633976
b75bff4b2a163b9e358b67a861d63041b8b25cd9b0b98c0397a0785a9e4d98eb
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c8322d2ef5133db4095a360bf3a008fbd9bcf41654afc17974f5b8146230cd02
caf5deed16ce6f86eb324117d79198edacf2f06eb51640482caf543d05187009
cd1707ff961932c5fe28a5722a31c9dbaad2b2e3dbc65ef5f28bcd101fbc1474
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d635525e019c41dc7afd21e3dfb2e44af7b53470fd648b0b40d05ff2098fc4d8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd0103b71a9f800bf8509fb3f34f29a1af4b26a10ceef71cea5bb29ae4ea106d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e53ed618b330ff0bf708d79f61c38056ff1bf0e63978f017410d157d084f2016
e997fc603bb925233e39dc8060429dad2a486736a1b8ff32ca74d0739fc4ddbb
ec917df7f0b9aea1811a82316b3a91d0751cda7a6eff394cdb4feb5983a56d2b
ee97deb871f1fdc91ff3363932be46c0fe0a3cc7e72f7d297c0fb229afd37e87
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8d499db825c8050e64bef5cb8e084f5176acc457b48592afea62f81001e487
f29b5a9c9a78bd710363d13f9c06afede0368f7d188fe54ab9ef16ceb6dee4d9
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
fad4503864826ee7ba5936c537cce3304a1caf98bc586b470eb3118ec3f2089f
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
ff137f1a0462e79c67dccba49c9388f797fa9accb9e7b84cd59c98e9f2aebaed

www.beckershospitalreview.com Open in urlscan Pro 67.227.242.177 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

107 Requests

100 %HTTPS

40 %IPv6

38 Domains

49 Subdomains

42 IPs

6 Countries

1279 kBTransfer

3198 kBSize

0 Cookies

50 Outgoing links

Redirected requests

107 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.beckershospitalreview.com Open in urlscan Pro
67.227.242.177 Public Scan

Screenshot
Live screenshot

Full Image

107
Requests

100 %
HTTPS

40 %
IPv6

38
Domains

49
Subdomains

42
IPs

6
Countries

1279 kB
Transfer

3198 kB
Size

0
Cookies

107 HTTP transactions
0 data transactions