blogs.arubanetworks.com Open in urlscan Pro
165.22.143.21  Public Scan

44 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

• https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&gjid=1374392256&_gid=2023851976.1574436712&_u=aGBAgEAj~&z=1349244718 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&_v=j79&z=1349244718 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&_v=j79&z=1349244718&slf_rd=1&random=4201159380

Request Chain 28

• https://s2048.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2048&ref2=elqNone&tzo=-60&ms=352&optin=disabled&firstPartyCookieDomain=etrack.ext.arubanetworks.com HTTP 302
• https://etrack.ext.arubanetworks.com/visitor/v200/svrGP.aspx?pps=3&siteid=2048&ref2=elqNone&tzo=-60&ms=352&optin=disabled&elq1pcGUID=E8A4A702609544C8828EF208D8D85491 HTTP 302
• https://etrack.ext.arubanetworks.com/error

Request Chain 41

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=390017&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&time=1574436714297 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D390017%26url%3Dhttps%253A%252F%252Fblogs.arubanetworks.com%252Findustries%252Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%252F%2523.XanbIa4oiPo.twitter%26time%3D1574436714297%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=390017&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&time=1574436714297&liSync=true

59 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/	38 KB 11 KB	500ms 180ms	Document text/html	165.22.143.21 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 165.22.143.21 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS 255983.cloudwaysapps.com Software nginx / Resource Hash 0d1aa03e250d823e9e86c6b075759b0a38627adb127be1fbbd939b347347a39a Request headers :method GET :authority blogs.arubanetworks.com :scheme https :path /industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 server nginx date Fri, 22 Nov 2019 15:31:51 GMT content-type text/html; charset=UTF-8 content-length 11267 last-modified Fri, 22 Nov 2019 12:12:07 GMT vary Accept-Encoding content-encoding gzip cache-control max-age=0 expires Fri, 22 Nov 2019 15:31:51 GMT
GET H2	200	css fonts.googleapis.com/	32 KB 1 KB	19ms 18ms	Stylesheet text/css	2a00:1450:4001:820::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C700%2C800%2C600%2C300%7COpen+Sans+Condensed%3A300%2C300italic%2C700 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 036a52ab8e147a34d6f114cedd75beca923fbbdc70d69c6c06d9cc6df630837f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Fri, 22 Nov 2019 15:31:51 GMT server ESF access-control-allow-origin * date Fri, 22 Nov 2019 15:31:51 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Fri, 22 Nov 2019 15:31:51 GMT
GET H2	200	042b72d521be429347972d766482d896.css 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/	88 KB 16 KB	101ms 49ms	Stylesheet text/css	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/042b72d521be429347972d766482d896.css Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 1ee92eba9001eef75982e26975cdfd6902d5b27dd87531ac5d29ce09bebdc714 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:51 GMT content-encoding gzip last-modified Thu, 14 Nov 2019 09:26:45 GMT server nginx access-control-allow-origin * vary Accept-Encoding, Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 status 200 cache-control max-age=31536000, public accept-ranges bytes link <https://blogs.arubanetworks.com/c/cache/min/1/042b72d521be429347972d766482d896.css>; rel="canonical" expires Fri, 13 Nov 2020 09:42:50 GMT
GET H2	200	jquery-1.10.0.min.js Show response 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/s/j/	91 KB 32 KB	92ms 41ms	Script application/javascript	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/s/j/jquery-1.10.0.min.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash effb5baf6ceaffa9216ee063839ec08bdc669b840accc11b4bf1dcc10b75cc60 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:51 GMT content-encoding gzip last-modified Fri, 29 Mar 2019 03:28:15 GMT server nginx access-control-allow-origin * vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript; charset=utf-8 status 200 cache-control max-age=31536000, public accept-ranges bytes link <https://blogs.arubanetworks.com/s/j/jquery-1.10.0.min.js>; rel="canonical" expires Wed, 29 Apr 2020 19:50:55 GMT
GET H2	200	util.aruba-gdpr.js Show response 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/s/j/	28 KB 10 KB	337ms 286ms	Script application/javascript	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/s/j/util.aruba-gdpr.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 47cf0745d63f81445f037afdb10f0021c5ae7d68b9c7490024ac6d5434c0f693 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:52 GMT content-encoding gzip last-modified Fri, 29 Mar 2019 03:28:15 GMT server nginx access-control-allow-origin * vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript; charset=utf-8 status 200 cache-control max-age=31536000, public accept-ranges bytes link <https://blogs.arubanetworks.com/s/j/util.aruba-gdpr.js>; rel="canonical" expires Wed, 29 Apr 2020 19:50:55 GMT
GET H2	200	aruba_logo.svg blogs.arubanetworks.com/s/i/	10 KB 3 KB	166ms 166ms	Image image/svg+xml	165.22.143.21 DigitalOcean
General Check archive.org Show headers Download Go to Show image Full URL https://blogs.arubanetworks.com/s/i/aruba_logo.svg Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 165.22.143.21 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS 255983.cloudwaysapps.com Software nginx / Resource Hash 32840ce8de2c8a3417fbdea61dff20b10153ea1f2d5ba5dfc8a373fb0162e36a Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:51 GMT content-encoding gzip last-modified Fri, 29 Mar 2019 03:05:22 GMT server nginx vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=2592000, public accept-ranges bytes content-length 3206 expires Sun, 22 Dec 2019 15:31:51 GMT
GET H2	200	d1dc2a9ee1c174b7d728945aaf8cabb4.js Show response 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/	3 MB 1012 KB	79ms 28ms	Script application/javascript	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/d1dc2a9ee1c174b7d728945aaf8cabb4.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 91292ec23e8de0b08a7c88ba638706349c4c70cc708105436215b207aec6c09a Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:51 GMT content-encoding gzip last-modified Thu, 14 Nov 2019 09:26:45 GMT server nginx access-control-allow-origin * vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript; charset=utf-8 status 200 cache-control max-age=31536000, public accept-ranges bytes link <https://blogs.arubanetworks.com/c/cache/min/1/d1dc2a9ee1c174b7d728945aaf8cabb4.js>; rel="canonical" expires Fri, 13 Nov 2020 09:42:50 GMT
GET H2	200	aruba_footer-logo.svg blogs.arubanetworks.com/s/i/	7 KB 2 KB	165ms 165ms	Image image/svg+xml	165.22.143.21 DigitalOcean
General Check archive.org Show headers Download Go to Show image Full URL https://blogs.arubanetworks.com/s/i/aruba_footer-logo.svg Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 165.22.143.21 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS 255983.cloudwaysapps.com Software nginx / Resource Hash ed612c0145a27371d661027cbe7d5dbab1f9d0e84dd2412970daf19b19fb09db Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:51 GMT content-encoding gzip last-modified Fri, 29 Mar 2019 03:05:22 GMT server nginx vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=2592000, public accept-ranges bytes content-length 2325 expires Sun, 22 Dec 2019 15:31:51 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	350 KB 51 KB	15ms 15ms	Script application/javascript	2a00:1450:4001:821::2008 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5C73LF Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash c5fc9e3f9452f58732f9bf6a8b36760491a5beebd5ed44f287d2005b39809391 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:52 GMT content-encoding br last-modified Fri, 22 Nov 2019 15:00:00 GMT server Google Tag Manager access-control-allow-origin http://www.googletagmanager.com vary Accept-Encoding content-type application/javascript; charset=UTF-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control content-length 52010 x-xss-protection 0 expires Fri, 22 Nov 2019 15:31:52 GMT
GET DATA	200 OK	truncated /	35 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a3479b45d477eb8429f4be8a396050d90f894559a72068ec3593ec43f586d138 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	aruba-sprite.png 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/wp-content/themes/Aruba-blog-2018/i/	5 KB 6 KB	18ms 17ms	Image image/png	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/wp-content/themes/Aruba-blog-2018/i/aruba-sprite.png Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 9324d343987adecf1833f64540a2bb68085e1e1f1fc0e2bab143527b0f16642c Request headers Referer https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/042b72d521be429347972d766482d896.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:52 GMT last-modified Fri, 29 Mar 2019 03:05:22 GMT server nginx access-control-allow-origin * etag "5c9d8b72-1567" x-cache HIT content-type image/png status 200 cache-control max-age=2592000 accept-ranges bytes link <https://blogs.arubanetworks.com/wp-content/themes/Aruba-blog-2018/i/aruba-sprite.png>; rel="canonical" content-length 5479 expires Wed, 27 Nov 2019 05:36:15 GMT
GET H2	200	mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C700%2C800%2C600%2C300%7COpen+Sans+Condensed%3A300%2C300italic%2C700 Origin https://blogs.arubanetworks.com Response headers date Wed, 20 Nov 2019 01:17:55 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:37 GMT server sffe age 224037 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9016 x-xss-protection 0 expires Thu, 19 Nov 2020 01:17:55 GMT
GET H2	200	mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C700%2C800%2C600%2C300%7COpen+Sans+Condensed%3A300%2C300italic%2C700 Origin https://blogs.arubanetworks.com Response headers date Wed, 20 Nov 2019 01:09:11 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:44 GMT server sffe age 224561 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9180 x-xss-protection 0 expires Thu, 19 Nov 2020 01:09:11 GMT
GET H2	200	mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C700%2C800%2C600%2C300%7COpen+Sans+Condensed%3A300%2C300italic%2C700 Origin https://blogs.arubanetworks.com Response headers date Tue, 19 Nov 2019 09:15:53 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:49 GMT server sffe age 281759 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9132 x-xss-protection 0 expires Wed, 18 Nov 2020 09:15:53 GMT
GET H2	200	mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C700%2C800%2C600%2C300%7COpen+Sans+Condensed%3A300%2C300italic%2C700 Origin https://blogs.arubanetworks.com Response headers date Wed, 20 Nov 2019 01:28:43 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:31:11 GMT server sffe age 223389 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9080 x-xss-protection 0 expires Thu, 19 Nov 2020 01:28:43 GMT
GET H2	200	lazyload-10.3.5.min.js Show response 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/v/wp-rocket/inc/front/js/	3 KB 2 KB	18ms 17ms	Script application/javascript	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/v/wp-rocket/inc/front/js/lazyload-10.3.5.min.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 1f01c860bdb5390bf81294d8b174c53072f9b9fe6ec5e7e3ac675329f1faca81 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:52 GMT content-encoding gzip last-modified Fri, 29 Mar 2019 03:28:13 GMT server nginx access-control-allow-origin * vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript; charset=utf-8 status 200 cache-control max-age=31536000, public accept-ranges bytes link <https://blogs.arubanetworks.com/v/wp-rocket/inc/front/js/lazyload-10.3.5.min.js>; rel="canonical" content-length 1439 expires Wed, 29 Apr 2020 19:50:57 GMT
GET H2	200	bugswat.php Show response bs.solutionfuse.com/	1 KB 1 KB	263ms 212ms	Script text/javascript	2606:4700:30::6818:6d7a Cloudflare
General Check archive.org Show headers Download Go to Full URL https://bs.solutionfuse.com/bugswat.php?f=sof9r2p Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::6818:6d7a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash de5b5540c205b5e96f3a653fc9d53e4904f82d1ebf080735e48ab6531c8cc2c7 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:52 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare etag W/"1551423324-d41d8cd98f00b204e9800998ecf8427e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/javascript;charset=UTF-8 status 200 cf-ray 539bf3ebbac95a06-VIE
GET H2	200	memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2 fonts.gstatic.com/s/opensans/v17/	10 KB 10 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2 Requested by Host: 255983-797043-raikfcquaxqncofqfm.stackpathdns.com URL: https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/d1dc2a9ee1c174b7d728945aaf8cabb4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C700%2C800%2C600%2C300%7COpen+Sans+Condensed%3A300%2C300italic%2C700 Origin https://blogs.arubanetworks.com Response headers date Thu, 21 Nov 2019 23:47:06 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:56 GMT server sffe age 56686 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9744 x-xss-protection 0 expires Fri, 20 Nov 2020 23:47:06 GMT
GET DATA	200 OK	truncated /	784 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4a402c5ab03950d109d5e0981f5be790a2b68c85cfd62f6fe885a77517fed15f Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	elqCfg.min.js Show response img.en25.com/i/	6 KB 3 KB	57ms 16ms	Script application/x-javascript	23.62.118.225 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://img.en25.com/i/elqCfg.min.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.62.118.225 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-62-118-225.deploy.static.akamaitechnologies.com Software / ASP.NET Resource Hash 6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains Content-Encoding gzip X-Content-Type-Options nosniff X-Powered-By ASP.NET P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Date Fri, 22 Nov 2019 15:31:52 GMT Connection keep-alive Content-Length 2115 Pragma no-cache Last-Modified Wed, 24 Jul 2019 19:48:25 GMT ETag "12d7dac15842d51:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-cache, no-store Accept-Ranges bytes Expires Fri, 22 Nov 2019 15:31:52 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	9ms 5ms	Script text/javascript	2a00:1450:4001:808::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5C73LF Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Aug 2019 17:22:41 GMT server Golfe2 age 3495 date Fri, 22 Nov 2019 14:33:37 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 17803 expires Fri, 22 Nov 2019 16:33:37 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	121 KB 26 KB	6ms 5ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash f20f83cb7683a1a3138cd52201d83436e33a5e67ef0b9c96bbdab860b5f7da16 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-23=":443"; ma=3600 content-length 26765 x-xss-protection 0 pragma public x-fb-debug nuprK9XXzcjOvGakV3wAznLuDBvAPu67GLVGXytp9uj0t+QBHga0kdfY5ArH+E3hMqkh/sQdN/3WAHVwVD6Muw== x-fb-trip-id 420120009 date Fri, 22 Nov 2019 15:31:52 GMT x-frame-options DENY content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	Ron-Kent-headshot.jpg media.arubanetworks.com/blogs/	238 KB 239 KB	1108ms 845ms	Image image/jpeg	13.225.78.49 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://media.arubanetworks.com/blogs/Ron-Kent-headshot.jpg Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.78.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-225-78-49.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 9581d1c70b4e0ccbb363a4531920eaba29c2e4d350b00eb73c15542605ad86f0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:54 GMT via 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront) last-modified Fri, 11 Oct 2019 01:00:07 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 etag "e826d0c572b2e577a5c32501f9691e99" x-cache Miss from cloudfront x-amz-version-id DLNnUbLc4R0ve_tyqlJOTY3hTuSGhNWY status 200 cache-control max-age=31536000 accept-ranges bytes content-type image/jpeg content-length 244089 x-amz-cf-id z0LhkqMGZiuPHYD_e5DbRWtsJKN_OImstdovrqRR5UeZNIKbjW4UIg== expires Sat, 10 Oct 2020 01:00:06 GMT
GET H2	200	GettyImages-906499300-1024x683.jpg media.arubanetworks.com/blogs/	149 KB 149 KB	1107ms 844ms	Image image/jpeg	13.225.78.49 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://media.arubanetworks.com/blogs/GettyImages-906499300-1024x683.jpg Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.78.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-225-78-49.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash e1a9766d2684e70702defc231544f2560bb6a0f9318058d1a2eaecac810aaeca Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:54 GMT via 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront) last-modified Mon, 07 Oct 2019 20:11:17 GMT server AmazonS3 x-amz-cf-pop FRA2-C2 etag "d741053d91dec80929a29413023bc21a" x-cache Miss from cloudfront x-amz-version-id SToAnrOmW_uiUUBmF5GYaRYa41Tjqty4 status 200 cache-control max-age=31536000 accept-ranges bytes content-type image/jpeg content-length 152290 x-amz-cf-id Yqzs4t-UqqMwpVWODoBwsjHW_Sq0xvXR_lpyfcen2NqAOEuTkrp8tg== expires Tue, 06 Oct 2020 20:11:15 GMT
GET H2	200	linkid.js Show response www.google-analytics.com/plugins/ua/	2 KB 923 B	6ms 6ms	Script text/javascript	2a00:1450:4001:808::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/linkid.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 14:38:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe age 3222 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=3600 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 859 x-xss-protection 0 expires Fri, 22 Nov 2019 15:38:10 GMT
GET H2	200	1366739190005727 Show response connect.facebook.net/signals/config/	349 KB 85 KB	8ms 7ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1366739190005727?v=2.9.13&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 000cb861afdc73d8afe425a4cfc1ec71aec63c5e28c89be96119af630490c8b2 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-23=":443"; ma=3600 content-length 87143 x-xss-protection 0 pragma public x-fb-debug pdLoXoL88RfJ7QDjKxxpOtzAKpCdcSsvRW+dAINtfYtAOXEqyfWhtdoE0i+EyaxTawYWoHoviCYqiqmz+ODyzw== x-fb-trip-id 420120009 date Fri, 22 Nov 2019 15:31:52 GMT x-frame-options DENY content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect www.google-analytics.com/	35 B 99 B	11ms 10ms	Image image/gif	2a00:1450:4001:808::200e Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j79&a=1239478052&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F&ul=en-us&de=UTF-8&dt=Ransomware%20Decoded%3A%20Five%20Keys%20To%20Detect%20Stealthy%20Attack%20Signals%20Early%20%7C%20Aruba%20Blogs&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBAgEAj~&jid=381913584&gjid=1374392256&cid=590583033.1574436712&tid=UA-64926302-1&_gid=2023851976.1574436712&gtm=2wgav95C73LF&cd1=.XanbIa4oiPo.twitter&z=514030483 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers pragma no-cache date Wed, 20 Nov 2019 05:23:35 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 209297 content-type image/gif status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control no-cache, no-store, must-revalidate access-control-allow-origin * content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&gjid=1374392256&_gid=2023851976.1574436712&_u=aGBAgEAj~&z=1349244718 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&_v=j79&z=1349244718 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&_v=j79&z=1349244718&slf_rd=1&random=4201159380	42 B 109 B	29ms 28ms	Image image/gif	2a00:1450:4001:806::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&_v=j79&z=1349244718&slf_rd=1&random=4201159380 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers pragma no-cache date Fri, 22 Nov 2019 15:31:52 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Fri, 22 Nov 2019 15:31:52 GMT x-content-type-options nosniff server cafe timing-allow-origin * location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-64926302-1&cid=590583033.1574436712&jid=381913584&_v=j79&z=1349244718&slf_rd=1&random=4201159380 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 cache-control no-cache, no-store, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	svrGP s704917861.t.eloqua.com/visitor/v200/	49 B 396 B	405ms 111ms	Image image/gif	142.0.160.53 Oracle Corporation
General Check archive.org Show headers Download Go to Show image Full URL https://s704917861.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=704917861&ref2=elqNone&tzo=-60&ms=352&optin=disabled Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 142.0.160.53 Ashburn, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US), Reverse DNS Software / ASP.NET Resource Hash f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab Security Headers Name Value Strict-Transport-Security max-age=31536000; X-Content-Type-Options nosniff Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; X-Content-Type-Options nosniff X-Powered-By ASP.NET P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Cache-Control private,no-cache, no-store Date Fri, 22 Nov 2019 15:31:52 GMT Content-Type image/gif Content-Length 49 Expires -1
GET H/1.1	200 OK	error etrack.ext.arubanetworks.com/ Redirect Chain https://s2048.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2048&ref2=elqNone&tzo=-60&ms=352&optin=disabled&firstPartyCookieDomain=etrack.ext.arubanetworks.com https://etrack.ext.arubanetworks.com/visitor/v200/svrGP.aspx?pps=3&siteid=2048&ref2=elqNone&tzo=-60&ms=352&optin=disabled&elq1pcGUID=E8A4A702609544C8828EF208D8D85491 https://etrack.ext.arubanetworks.com/error	0 0	158ms 158ms	Image text/html	142.0.160.57 Oracle Corporation
General Check archive.org Show headers Download Go to Show image Full URL https://etrack.ext.arubanetworks.com/error Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 142.0.160.57 Ashburn, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Fri, 22 Nov 2019 15:31:52 GMT X-Content-Type-Options nosniff Transfer-Encoding chunked P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Location /error Cache-Control private,no-cache, no-store Content-Type text/html; charset=utf-8 Expires -1
GET H2	200	/ www.facebook.com/tr/	44 B 258 B	7ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1366739190005727&ev=PageView&dl=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&rl=&if=false&ts=1574436712382&sw=1600&sh=1200&v=2.9.13&r=stable&ec=0&o=30&fbp=fb.1.1574436712381.948828845&it=1574436712345&coo=false&rqm=GET Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:52 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-23=":443"; ma=3600 content-length 44 expires Fri, 22 Nov 2019 15:31:52 GMT
POST H2	200	/ www.facebook.com/tr/	0 88 B	6ms 6ms	Other text/plain	2a03:2880:f11c:8183:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryvpyQlTYXyMCpHi82 Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt access-control-allow-origin https://blogs.arubanetworks.com date Fri, 22 Nov 2019 15:31:52 GMT content-type text/plain status 200 access-control-allow-credentials true alt-svc h3-23=":443"; ma=3600 content-length 0
GET H/1.1	200 OK	relatedthreads Show response community.arubanetworks.com/aruba/plugins/custom/aruba/aruba/	2 KB 2 KB	950ms 293ms	XHR text/html	208.74.205.195 Lithium Technologies
General Check archive.org Show headers Download Go to Full URL https://community.arubanetworks.com/aruba/plugins/custom/aruba/aruba/relatedthreads?tags=%27AI%27%2C%27IntroSpect%27%2C%27Machine+Learning%27%2C%27Network+Security%27%2C%27Network+Traffic+Analysis%27%2C%27Ransomware%27%2C%27Security%27%2C%27UEBA%27 Requested by Host: 255983-797043-raikfcquaxqncofqfm.stackpathdns.com URL: https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/s/j/jquery-1.10.0.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 208.74.205.195 , United States, ASN40402 (LITHIUM - Lithium Technologies, Inc., US), Reverse DNS aruba.lithium.com Software Apache / Resource Hash d894d61a32c406cf4ed604f97e40e9b530331743f9b6d5e0232613dea0dae52b Request headers Accept */* Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Pragma no-cache Date Fri, 22 Nov 2019 15:31:53 GMT Content-Encoding gzip Server Apache Vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding Content-Language en-US Access-Control-Allow-Origin https://blogs.arubanetworks.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection close Content-Type text/html;charset=UTF-8 Transfer-Encoding chunked Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	addthis_widget.js Show response s7.addthis.com/js/300/	349 KB 113 KB	107ms 48ms	Script application/javascript	2.21.36.164 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/js/300/addthis_widget.js Requested by Host: 255983-797043-raikfcquaxqncofqfm.stackpathdns.com URL: https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/s/j/jquery-1.10.0.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-36-164.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash 7c20e3e201e3d7c6821e907def1257deb544eb08578c7129b96d53bbf62d34e4 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 30 Oct 2019 19:35:04 GMT server nginx/1.15.8 etag "5db9e5e8-57446" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Fri, 22 Nov 2019 15:31:53 GMT x-host s7.addthis.com content-length 114924
GET H/1.1	200 OK	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	383ms 300ms	Script application/x-javascript	72.247.226.64 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a72-247-226-64.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Date Fri, 22 Nov 2019 15:31:53 GMT Content-Encoding gzip Last-Modified Fri, 08 Nov 2019 20:13:52 GMT Server AmazonS3 x-amz-request-id CD83941857724976 ETag "f14b4e1f799b14f798a195f43cf58376" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=24939 Connection keep-alive Accept-Ranges bytes Content-Length 948 x-amz-id-2 0ZTpgIpnUMxQCBXeH9ew/82I9oq7GJ2Gfze78bXzMcqS1BRoWTIwh8fvZ+vN96IwbFGZ6f5C0Hk=
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-5ae40998070647ee/	2 KB 877 B	211ms 209ms	Script application/javascript	2.21.36.164 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-5ae40998070647ee/_ate.track.config_resp Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-36-164.deploy.static.akamaitechnologies.com Software Jetty(9.4.8.v20180619) / Resource Hash 977a6a70d60ed0e69cd81bf414e5e33a015c0e671844e0399628d56bf4fcad68 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip surrogate-key ra-5ae40998070647ee server Jetty(9.4.8.v20180619) etag 1334354849--gzip vary Accept-Encoding cache-tag ra-5ae40998070647ee status 200 cache-control public, max-age=60, s-maxage=86400 content-disposition attachment; filename=1.txt content-type application/javascript;charset=utf-8 content-length 631
POST H2	200	admin-ajax.php Show response blogs.arubanetworks.com/manager/	39 B 513 B	463ms 463ms	XHR text/html	165.22.143.21 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://blogs.arubanetworks.com/manager/admin-ajax.php Requested by Host: 255983-797043-raikfcquaxqncofqfm.stackpathdns.com URL: https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/d1dc2a9ee1c174b7d728945aaf8cabb4.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 165.22.143.21 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS 255983.cloudwaysapps.com Software nginx / Resource Hash 72586401507d6d6ecce14f1f71ffcab55ab3e9e0a07459fdb626c5123ba135f9 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip referrer-policy strict-origin-when-cross-origin server nginx status 200 x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 access-control-allow-origin https://blogs.arubanetworks.com cache-control no-cache, must-revalidate, max-age=0 access-control-allow-credentials true x-robots-tag noindex vary Accept-Encoding content-length 57 x-content-type-options nosniff expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	25 KB 10 KB	84ms 32ms	Script text/javascript	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5C73LF Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software cafe / Resource Hash 69e3a796f4b120879065a812b95b56fd4d28f88faf8c1976ad9b0fa2f31dc0eb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9614 x-xss-protection 0 server cafe etag 5296095546589048175 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 22 Nov 2019 15:31:54 GMT
GET H/1.1	200 OK	insight.min.js Show response sjs.bizographics.com/	3 KB 2 KB	32ms 9ms	Script application/x-javascript	2a02:26f0:10c:38f::3adf AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sjs.bizographics.com/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5C73LF Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:38f::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Date Fri, 22 Nov 2019 15:31:54 GMT Content-Encoding gzip Last-Modified Mon, 07 Oct 2019 16:41:31 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=43255 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	98f35b81-fdec-46e2-baf7-ab3a283a101a.js Show response cdnssl.clicktale.net/www11/ptc/	50 KB 12 KB	34ms 9ms	Script text/javascript	2a02:26f0:10c:387::2db0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdnssl.clicktale.net/www11/ptc/98f35b81-fdec-46e2-baf7-ab3a283a101a.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:387::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash e0ac9c2effa39b4fc16a0ad43843d3d2a26e0601d77340a11e837077a843aeee Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip access-control-allow-origin * vary Accept-Encoding content-type text/javascript; charset=utf-8 status 200 cache-control public, max-age=600 content-length 11996 expires Fri, 22 Nov 2019 15:41:54 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	14 KB 6 KB	227ms 25ms	Script application/javascript	23.8.5.174 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.5.174 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a23-8-5-174.deploy.static.akamaitechnologies.com Software nginx/1.10.3 (Ubuntu) / Resource Hash 2335c33eb5a01923289f963f81f2bec6dfa7dd1652f6f3e1e48a248acf675d79 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Date Fri, 22 Nov 2019 15:31:54 GMT Content-Encoding gzip Last-Modified Wed, 13 Nov 2019 07:13:49 GMT Server nginx/1.10.3 (Ubuntu) ETag "5dcbad2d-368c" Vary Accept-Encoding Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Access-Control-Max-Age 86400 Access-Control-Allow-Credentials true Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 5800
GET H/1.1	200 OK	up_loader.1.1.0.js Show response js.adsrvr.org/	4 KB 2 KB	95ms 30ms	Script application/x-javascript	13.225.83.200 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/up_loader.1.1.0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5C73LF Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.83.200 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-225-83-200.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 3facb0fb4999f0b5d8116ce812c1d68d07b17782afb8cc480ae472ea6c5094fe Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Date Tue, 19 Nov 2019 21:19:33 GMT Content-Encoding gzip Last-Modified Tue, 19 Nov 2019 21:15:10 GMT Server AmazonS3 Age 65539 Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/x-javascript Via 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront) Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C2 Connection keep-alive X-Amz-Cf-Id 96njaUwUsjiXlLyehFI39LP2tr8O-k6CVFqqIStuVZHd9grfyefDjg==
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=390017&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D390017%26url%3Dhttps%253A%252F%252Fblogs.arubanetworks.com%252Findustries%252Fran... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=390017&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4...	0 70 B	106ms 106ms	Image application/javascript	2a05:f500:10:101::b93f:9105 LinkedIn Corporation
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=390017&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&time=1574436714297&liSync=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip server Play vary Accept-Encoding x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-efr5 content-type application/javascript content-length 20 x-li-uuid wAmmotmF2RVQzru/XSsAAA== Redirect headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip x-content-type-options nosniff status 302 x-li-pop prod-tln1 content-length 20 x-li-uuid UOBEnNmF2RUghPepZSsAAA== pragma no-cache server Play x-frame-options sameorigin expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" vary Accept-Encoding strict-transport-security max-age=2592000 x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=390017&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&time=1574436714297&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	monitor-latest.js Show response cdnssl.clicktale.net/www/	61 KB 19 KB	11ms 9ms	Script application/javascript	2a02:26f0:10c:387::2db0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdnssl.clicktale.net/www/monitor-latest.js Requested by Host: cdnssl.clicktale.net URL: https://cdnssl.clicktale.net/www11/ptc/98f35b81-fdec-46e2-baf7-ab3a283a101a.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:387::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 9d8a2811fe6cec544f8e4ba7915c7ee8d4caa72257d97bf4f8964dae6c621ff6 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip last-modified Sun, 07 Apr 2019 08:45:15 GMT server Microsoft-IIS/8.5 access-control-allow-origin * etag "809f4d381eedd41:0" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=86400 accept-ranges bytes content-length 19662 expires Sat, 23 Nov 2019 15:31:54 GMT
GET H2	200	98f35b81-fdec-46e2-baf7-ab3a283a101a.js Show response cdnssl.clicktale.net/www11/pcc/	69 KB 18 KB	18ms 17ms	Script text/javascript	2a02:26f0:10c:387::2db0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdnssl.clicktale.net/www11/pcc/98f35b81-fdec-46e2-baf7-ab3a283a101a.js?DeploymentConfigName=Release_20190506&Version=2 Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:387::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 93eca5778a38251b6d028ef9059b80ac76d0f19ce8cd1b4bd516cd353a0275fe Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip access-control-allow-origin * vary Accept-Encoding content-type text/javascript; charset=utf-8 status 200 cache-control public, max-age=86400 content-length 18276 expires Sat, 23 Nov 2019 15:31:54 GMT
GET H2	200	WR-latest.js Show response cdnssl.clicktale.net/www/	55 KB 19 KB	10ms 9ms	Script application/javascript	2a02:26f0:10c:387::2db0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdnssl.clicktale.net/www/WR-latest.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:387::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash bcfca2eaed822191dee3275828f70a74476c84f2e3a927c1f49cf7b6da7e3436 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip last-modified Sun, 27 Oct 2019 12:47:27 GMT server Microsoft-IIS/8.5 access-control-allow-origin * etag "8019e8afc48cd51:0" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=86400 accept-ranges bytes content-length 18702 expires Sat, 23 Nov 2019 15:31:54 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1013522429/	2 KB 2 KB	44ms 21ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1013522429/?random=1574436714313&cv=9&fst=1574436714313&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgav9&sendb=1&ig=1&data=google_custom_params%3Dwindow.google_tag_params&frm=0&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F&tiba=Ransomware%20Decoded%3A%20Five%20Keys%20To%20Detect%20Stealthy%20Attack%20Signals%20Early%20%7C%20Aruba%20Blogs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash a65ec4d38d6044ed9b7d9f6420f02564f4b4d14ebbc150c0cebaa5443dcd1ab8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers pragma no-cache date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip x-content-type-options nosniff content-type text/javascript; charset=UTF-8 server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1057 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	monitor conductor.clicktale.net/	1 B 261 B	494ms 127ms	Other text/plain	52.1.226.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://conductor.clicktale.net/monitor?t=preinit&p=208&2=8044104900627413&v=1.5.5&7=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&3=5830957619016656&4=8539906719087799&5=0 Requested by Host: cdnssl.clicktale.net URL: https://cdnssl.clicktale.net/www/monitor-latest.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.1.226.58 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-1-226-58.compute-1.amazonaws.com Software / Resource Hash 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://blogs.arubanetworks.com Date Fri, 22 Nov 2019 15:31:54 GMT Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 1 Content-Type text/plain
GET H/1.1	200 OK	monitor Show response conductor.clicktale.net/	1 B 270 B	484ms 121ms	XHR text/plain	52.1.226.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://conductor.clicktale.net/monitor?t=auth&p=208&2=8044104900627413&v=1.5.5 Requested by Host: cdnssl.clicktale.net URL: https://cdnssl.clicktale.net/www/monitor-latest.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.1.226.58 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-1-226-58.compute-1.amazonaws.com Software / Resource Hash 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Content-Type text/plain Response headers Date Fri, 22 Nov 2019 15:31:54 GMT Vary * Content-Type text/plain Access-Control-Allow-Origin https://blogs.arubanetworks.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 1
GET H2	200	up insight.adsrvr.org/track/ Frame 5219	0 0	103ms 34ms	Document text/html	34.248.255.146 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://insight.adsrvr.org/track/up?adv=mn1qdic&ref=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&upid=qqx8u5t&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.248.255.146 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-248-255-146.eu-west-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority insight.adsrvr.org :scheme https :path /track/up?adv=mn1qdic&ref=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F%23.XanbIa4oiPo.twitter&upid=qqx8u5t&upv=1.1.0 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site sec-fetch-mode nested-navigate referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Response headers status 200 date Fri, 22 Nov 2019 15:31:54 GMT content-type text/html cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
GET H2	200	ChangeMonitor-latest.js Show response cdnssl.clicktale.net/www/	47 KB 16 KB	12ms 12ms	Script application/javascript	2a02:26f0:10c:387::2db0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdnssl.clicktale.net/www/ChangeMonitor-latest.js Requested by Host: blogs.arubanetworks.com URL: https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:387::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 1958bb7f293956e7170f639ce93a3d628ae465fa24fd751e1a2b3cd837059ffa Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com Response headers date Fri, 22 Nov 2019 15:31:54 GMT content-encoding gzip last-modified Tue, 19 Mar 2019 09:03:36 GMT server Microsoft-IIS/8.5 access-control-allow-origin * etag "0a4b3a232ded41:0" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=86400 accept-ranges bytes content-length 15711 expires Sat, 23 Nov 2019 15:31:54 GMT
POST H/1.1	200 OK	/ Show response ing-district.clicktale.net/ctn_v2/auth/	260 B 510 B	709ms 120ms	XHR application/json	52.207.122.234 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://ing-district.clicktale.net/ctn_v2/auth/?pid=315&as=1&34914357&subsid=120273&msgsize=20 Requested by Host: cdnssl.clicktale.net URL: https://cdnssl.clicktale.net/www/WR-latest.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.207.122.234 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-207-122-234.compute-1.amazonaws.com Software / Resource Hash 3cb871447d763c59c88eca1a460c741702de3cc706f51ff8d66da50e7c3801fa Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://blogs.arubanetworks.com Date Fri, 22 Nov 2019 15:31:54 GMT Access-Control-Allow-Credentials true Connection keep-alive Content-Length 260 Content-Type application/json; charset=UTF-8
GET H2	200	/ www.google.com/pagead/1p-user-list/1013522429/	42 B 167 B	24ms 23ms	Image image/gif	2a00:1450:4001:818::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1013522429/?random=1574436714313&cv=9&fst=1574434800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgav9&sendb=1&data=google_custom_params%3Dwindow.google_tag_params&frm=0&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F&tiba=Ransomware%20Decoded%3A%20Five%20Keys%20To%20Detect%20Stealthy%20Attack%20Signals%20Early%20%7C%20Aruba%20Blogs&async=1&fmt=3&is_vtc=1&random=966772036&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers pragma no-cache date Fri, 22 Nov 2019 15:31:54 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1013522429/	42 B 156 B	22ms 22ms	Image image/gif	2a00:1450:4001:806::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1013522429/?random=1574436714313&cv=9&fst=1574434800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgav9&sendb=1&data=google_custom_params%3Dwindow.google_tag_params&frm=0&url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F&tiba=Ransomware%20Decoded%3A%20Five%20Keys%20To%20Detect%20Stealthy%20Attack%20Signals%20Early%20%7C%20Aruba%20Blogs&async=1&fmt=3&is_vtc=1&random=966772036&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers pragma no-cache date Fri, 22 Nov 2019 15:31:54 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	layers.ab5cd98fe1b9a38a4a9f.js Show response s7.addthis.com/static/	263 KB 76 KB	29ms 29ms	Script application/javascript	2.21.36.164 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-36-164.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-41b9f" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Fri, 22 Nov 2019 15:31:54 GMT x-host s7.addthis.com timing-allow-origin * content-length 77528
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 379 B	80ms 25ms	XHR text/plain	23.8.5.174 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.5.174 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a23-8-5-174.deploy.static.akamaitechnologies.com Software / Resource Hash 2782b167e77f1460a55f7e30bc2de9d1cb2860b77f979b25ebe6e691128b8da3 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com Response headers Date Fri, 22 Nov 2019 15:31:54 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://blogs.arubanetworks.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 627 B	309ms 244ms	Image image/gif	23.8.5.174 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=a414a4100e8f399a9ce32221adbbf641&svisitor=&visitor=5f1b3298-4a09-4ced-8448-463e009f48c3&session=7009f396-bfe4-4e95-82fe-a8975d35df3b&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%20Decoded%3A%20Five%20Keys%20To%20Detect%20Stealthy%20Attack%20Signals%20Early%20%7C%20Aruba%20Blogs%22%7D&cb=36714453&r=&thirdParty=%7B%7D Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.5.174 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a23-8-5-174.deploy.static.akamaitechnologies.com Software nginx/1.10.3 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Date Fri, 22 Nov 2019 15:31:54 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 19 Oct 2018 10:50:03 GMT Server nginx/1.10.3 (Ubuntu) ETag "5bc9b6db-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	shares.json Show response api-public.addthis.com/url/	34 B 344 B	230ms 229ms	Script application/json	2.21.36.164 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F&callback=_ate.cbs.rcb_cfz40 Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-36-164.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash 6f2e2c09304087d124a2e565d19233a61a77ee8ad1a235e1dd7fd9faa419e8e2 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip surrogate-key blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ last-modified Fri, 22 Nov 2019 15:31:55 GMT server nginx/1.15.8 date Fri, 22 Nov 2019 15:31:55 GMT vary Accept-Encoding content-type application/json status 200 cache-control no-transform, must-revalidate, max-age=0, s-maxage=3600 content-length 54
GET H2	200	shares.json Show response api-public.addthis.com/url/	34 B 344 B	243ms 242ms	Script application/json	2.21.36.164 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fblogs.arubanetworks.com%2Findustries%2Fransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early%2F&callback=_ate.cbs.rcb_fjom0 Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-36-164.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash 459a38764913c6815c2a21f9f340c00cc8c99c49f54b0306965a83ad915289ab Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip surrogate-key blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ last-modified Fri, 22 Nov 2019 15:31:55 GMT server nginx/1.15.8 date Fri, 22 Nov 2019 15:31:55 GMT vary Accept-Encoding content-type application/json status 200 cache-control no-transform, must-revalidate, max-age=0, s-maxage=3600 content-length 54
GET H2	200	aruba-sprite.png 255983-797043-raikfcquaxqncofqfm.stackpathdns.com/wp-content/themes/Aruba-blog-2018/i/	5 KB 6 KB	16ms 16ms	Image image/png	151.139.245.21 Highwinds Network...
General Check archive.org Show headers Download Go to Show image Full URL https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/wp-content/themes/Aruba-blog-2018/i/aruba-sprite.png Requested by Host: s7.addthis.com URL: https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.245.21 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 9324d343987adecf1833f64540a2bb68085e1e1f1fc0e2bab143527b0f16642c Request headers Referer https://255983-797043-raikfcquaxqncofqfm.stackpathdns.com/c/cache/min/1/042b72d521be429347972d766482d896.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Fri, 22 Nov 2019 15:31:54 GMT last-modified Fri, 29 Mar 2019 03:05:22 GMT server nginx access-control-allow-origin * etag "5c9d8b72-1567" x-cache HIT content-type image/png status 200 cache-control max-age=2592000 accept-ranges bytes link <https://blogs.arubanetworks.com/wp-content/themes/Aruba-blog-2018/i/aruba-sprite.png>; rel="canonical" content-length 5479 expires Wed, 27 Nov 2019 05:36:15 GMT
POST H/1.1	200 OK	monitor Show response conductor.clicktale.net/	1 B 261 B	485ms 121ms	XHR text/plain	52.1.226.58 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://conductor.clicktale.net/monitor?t=init&p=208&2=8044104900627413&v=1.5.5 Requested by Host: cdnssl.clicktale.net URL: https://cdnssl.clicktale.net/www/monitor-latest.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.1.226.58 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-1-226-58.compute-1.amazonaws.com Software / Resource Hash 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068 Request headers Referer https://blogs.arubanetworks.com/industries/ransomware-decoded-five-keys-to-detect-stealthy-attack-signals-early/ Origin https://blogs.arubanetworks.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://blogs.arubanetworks.com Date Fri, 22 Nov 2019 15:31:56 GMT Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 1 Content-Type text/plain