www.theregister.co.uk Open in urlscan Pro
104.18.235.86 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Submission: On March 26 via api (March 26th 2020, 3:31:32 pm UTC) from US

Summary HTTP 102 Redirects Links 33 Behaviour Indicators

Summary

This website contacted 17 IPs in 4 countries across 14 domains to perform 102 HTTP transactions. The main IP is 104.18.235.86, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.theregister.co.uk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 4th 2019. Valid for: a year.

This is the only time www.theregister.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 31	104.18.235.86 104.18.235.86	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
17	2606:4700::68... 2606:4700::6810:5351	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE)
3	95.101.185.159 95.101.185.159	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	13.224.194.122 13.224.194.122	16509 (AMAZON-02) (AMAZON-02)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE)
1	95.101.186.38 95.101.186.38	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:6ea0:c71... 2a02:6ea0:c710::2	60068 (CDN77) (CDN77)
3	70.42.32.31 70.42.32.31	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	151.101.14.2 151.101.14.2	54113 (FASTLY) (FASTLY)
1	34.232.73.12 34.232.73.12	14618 (AMAZON-AES) (AMAZON-AES)
102	17

31 104.18.235.86 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.theregister.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
nir.theregister.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.theregister.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700::6810:5351 (United States)

ASN13335 (CLOUDFLARENET, US)

regmedia.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.101.185.159 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-185-159.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.122 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-122.fra2.r.cloudfront.net

pj.l.admedo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.186.38 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-101-186-38.deploy.static.akamaitechnologies.com

tcheck.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c710::2 (Germany)

ASN60068 (CDN77, GB)

ob.cheqzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 70.42.32.31 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

log.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.232.73.12 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-73-12.compute-1.amazonaws.com

obs.cheqzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	theregister.co.uk 1 redirects www.theregister.co.uk nir.theregister.co.uk go.theregister.co.uk	156 KB
17	regmedia.co.uk regmedia.co.uk	121 KB
15	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	555 KB
13	ampproject.org cdn.ampproject.org	555 KB
10	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net	113 KB
4	outbrainimg.com tcheck.outbrainimg.com log.outbrainimg.com	1 KB
4	outbrain.com widgets.outbrain.com odb.outbrain.com	45 KB
2	cheqzone.com ob.cheqzone.com obs.cheqzone.com	16 KB
2	googletagservices.com www.googletagservices.com	55 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	google.com 1 redirects adservice.google.com www.google.com	362 B
1	google.de www.google.de	109 B
1	admedo.com pj.l.admedo.com	3 KB
1	google.co.uk adservice.google.co.uk	839 B
102	14

	Domain	Requested by
26	www.theregister.co.uk	www.theregister.co.uk
17	regmedia.co.uk	www.theregister.co.uk
13	cdn.ampproject.org	securepubads.g.doubleclick.net
11	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.theregister.co.uk cdn.ampproject.org tpc.googlesyndication.com
9	securepubads.g.doubleclick.net	www.theregister.co.uk securepubads.g.doubleclick.net
4	pagead2.googlesyndication.com	www.theregister.co.uk securepubads.g.doubleclick.net
4	nir.theregister.co.uk	www.theregister.co.uk
3	log.outbrainimg.com	widgets.outbrain.com
3	widgets.outbrain.com	www.theregister.co.uk widgets.outbrain.com
2	www.googletagservices.com	securepubads.g.doubleclick.net
2	www.google-analytics.com	www.theregister.co.uk
1	obs.cheqzone.com	ob.cheqzone.com
1	odb.outbrain.com	widgets.outbrain.com
1	go.theregister.co.uk	1 redirects
1	ob.cheqzone.com	widgets.outbrain.com
1	tcheck.outbrainimg.com	widgets.outbrain.com
1	www.google.de	www.theregister.co.uk
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	pj.l.admedo.com	www.theregister.co.uk
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.co.uk	securepubads.g.doubleclick.net
102	22

This site contains links to these domains. Also see Links.

Domain
account.theregister.co.uk
search.theregister.co.uk
forums.theregister.co.uk
www.reddit.com
twitter.com
www.facebook.com
www.linkedin.com
www.motherjones.com
www.carbonblack.com
champcoprepares.com
news.illinois.edu
go.theregister.co.uk
whitepapers.theregister.co.uk
situationpublishing.com
www.nextplatform.com
devclass.com
blocksandfiles.com
continuouslifecycle.london
www.mcubed.london

Subject Issuer	Validity	Valid
theregister.co.uk CloudFlare Inc ECC CA-2	`2019-10-04` - `2020-10-03`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
ssl909866.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-10-31` - `2020-05-08`	6 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2021-06-08`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
pj.l.admedo.com Amazon	`2019-07-05` - `2020-08-05`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.outbrainimg.com DigiCert SHA2 Secure Server CA	`2019-02-24` - `2020-05-25`	a year	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
ob.cheqzone.com Let's Encrypt Authority X3	`2020-03-16` - `2020-06-14`	3 months	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-03-03` - `2020-07-25`	5 months	crt.sh
obs.cheqzone.com Let's Encrypt Authority X3	`2020-02-22` - `2020-05-22`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Frame ID: 144FF2B734E2DF54DDAB06C4E6E56A61
Requests: 71 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Frame ID: EF2512293FA6BC5BD7F2BF8819ADE026
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: 7AFB470E1B0EFE174B69549732793B02
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: B91F3940A8A83905B3D8001FECEFFD0E
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: F05333EF80CBC50BCD3D1F24ADE08C01
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: DF68463E8924BE69A811F11EC6C47229
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstUCWxfkRZ-lP989yixhBImC5ZVjQVp1-f9xbLpXjaP7dJjDjHL-YCfE4cCUTsdUwFZVBhCqdYo2UjIcBOSeaEJPBvIHbej_eRJSYCgztj_qwr4DzBLZoUIWcwh3rwoSeNaxrzGUubEx-l5bmHPCYUTN54sH60y7aQ-yco0W7_myQiTY0gNGddObSVX9MlxKC9niqhcFezuQhVKp44dcOJcGhp_iGQbCZjiTV7m8TzVYMjjrIjCZN92IgiPMMmo_suU6uF0WWkkKHKjUzbWU2l-Xg&sai=AMfl-YRxfPUh9EI_UWYjisrKnojEQIm453zpaV2O0XjtMfK4X6Uvoqwh6P-Ty-xv4BF1s3vvs_fK-gIuu5JkgMbbCQmHyGTV-JGL-OP1rC6q&sig=Cg0ArKJSzJi_iX5vgJaJEAE&urlfix=1&adurl=
Frame ID: DE81D7E6A6543E1D91A7BC944A5F6657
Requests: 3 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: A6CE996D8C3EDC5EE40A319ABE80901F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 9C3A9C1FBDD9A6CAA14B70A9F7E5BE52
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

102
Requests

100 %
HTTPS

56 %
IPv6

14
Domains

22
Subdomains

17
IPs

4
Countries

1639 kB
Transfer

3817 kB
Size

15
Cookies

33 Outgoing links

These are links going to different origins than the main page.

URL: https://account.theregister.co.uk/login?r=https%3A//www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Title: Sign in

Search URL Search Domain Scan URL

URL: https://search.theregister.co.uk/
Title:

Search URL Search Domain Scan URL

URL: https://forums.theregister.co.uk/forum/all/2020/03/12/ransomware_illinois_health/
Title: 26

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/&title=Fresh%20virus%20misery%20for%20Illinois%3A%20Public%20health%20agency%20taken%20down%20by...%20web%20ransomware.%20Great%20timing%2C%20scumbags
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Fresh%20virus%20misery%20for%20Illinois%3A%20Public%20health%20agency%20taken%20down%20by...%20web%20ransomware.%20Great%20timing%2C%20scumbags&url=https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/&via=theregister
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/dialog/feed?app_id=727516617265205&display=popup&link=https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/&redirect_uri=https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/&title=Fresh%20virus%20misery%20for%20Illinois%3A%20Public%20health%20agency%20taken%20down%20by...%20web%20ransomware.%20Great%20timing%2C%20scumbags&summary=Not%20like%20anyone%20is%20looking%20for%20medical%20advice%20right%20now
Title:

Search URL Search Domain Scan URL

URL: https://www.motherjones.com/politics/2020/03/illinois-ransomware-coronavirus/
Title: earlier report

Search URL Search Domain Scan URL

URL: https://www.carbonblack.com/2020/02/07/threat-analysis-unit-tau-threat-intelligence-notification-mailto-netwalker-ransomware/
Title: Netwalker ransomware

Search URL Search Domain Scan URL

URL: http://champcoprepares.com/
Title: alternate website

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CUPHD/
Title: Facebook page

Search URL Search Domain Scan URL

URL: https://news.illinois.edu/view/6367/807187
Title: said yesterday

Search URL Search Domain Scan URL

URL: https://go.theregister.co.uk/tl/1910/-8373/practical-tips-for-office-365-tenant-to-tenant-migration?td=wptl1910bt
Title: Practical tips for Office 365 tenant-to-tenant migration

Search URL Search Domain Scan URL

URL: https://account.theregister.co.uk/register/?product=thereg_daily_newsletter
Title: Sign up to our NewsletterGet IT in your inbox daily

Search URL Search Domain Scan URL

URL: https://account.theregister.co.uk/register/?product=thereg_weekly_newsletter&utm_medium=site&utm_source=article&utm_campaign=story_rhs_ml_signup
Title: SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER SUBSCRIBE

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/
Title: Tech Resources

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/8471/google-security-whitepaper?td=s-uu
Title: Google Security Whitepaper This paper outlines Google’s approach to security and compliance for Google Cloud, their suite of public cloud products and services.

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/8322/why-dumping-spreadsheets-can-supercharge-your-business?td=s-uu
Title: Why Dumping Spreadsheets can Supercharge your Business This white paper looks at five areas where growing businesses commonly use spreadsheets and the impact they have on operations.

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/8438/four-technologies-combine-to-protect-you-from-ransomware-attacks?td=s-uu
Title: Four Technologies Combine To Protect You From Ransomware Attacks This paper explores the technologies and proactive strategies that Infrastructure & Operations professionals must employ to improve their confidence and recoverability in the face of a ransomware attack.

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/paper/view/8269/2018-user-risk-report?td=s-uu
Title: 2018 User Risk Report What do today’s employees really know about cybersecurity topics and best practices that protect data and network security?

Search URL Search Domain Scan URL

URL: https://situationpublishing.com/home/contact-us/
Title: Advertise with us

Search URL Search Domain Scan URL

URL: https://forums.theregister.co.uk/
Title: Forums

Search URL Search Domain Scan URL

URL: https://whitepapers.theregister.co.uk/events/list
Title: Webinars

Search URL Search Domain Scan URL

URL: https://www.nextplatform.com/
Title: The Next Platform

Search URL Search Domain Scan URL

URL: https://devclass.com/
Title: DevClass

Search URL Search Domain Scan URL

URL: https://blocksandfiles.com/
Title: Blocks and Files

Search URL Search Domain Scan URL

URL: https://continuouslifecycle.london/
Title: Continuous Lifecycle London

Search URL Search Domain Scan URL

URL: http://www.mcubed.london/
Title: M-cubed

Search URL Search Domain Scan URL

URL: https://situationpublishing.com/
Title:

Search URL Search Domain Scan URL

URL: https://account.theregister.co.uk/alert/?create=1
Title: News alerts

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/user?screen_name=theregister
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/VultureCentral
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/the-register
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&gjid=1542511278&_gid=1235985434.1585236665&_u=YGBAiAABB~&z=2010034508 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&_v=j81&z=2010034508 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&_v=j81&z=2010034508&slf_rd=1&random=2681409907

Request Chain 92

https://go.theregister.co.uk/k/abt_a HTTP 302
https://regmedia.co.uk/2007/09/13/tp.gif

102 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.theregister.co.uk/2020/03/12/ransomware_illinois_health/ 64 KB
15 KB 155ms
105ms Document
text/html 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 656bd284abc1cd57ef7f0560f38010715977ce8976d079c14bc896efdd3e58c6

Request headers

:method: GET
:authority: www.theregister.co.uk
:scheme: https
:path: /2020/03/12/ransomware_illinois_health/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Thu, 26 Mar 2020 15:31:04 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d9eeeb9f88c10faadde3c5a33301018f01585236664; expires=Sat, 25-Apr-20 15:31:04 GMT; path=/; domain=.theregister.co.uk; HttpOnly; SameSite=Lax
cache-control: max-age=0
expires: Thu, 26 Mar 2020 15:31:04 GMT
vary: Accept-Encoding
x-reg-bofh: pfy01gb
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 57a1ea9e8cd9f3eb-LHR
content-encoding: br

GET
H2 200 scaffolding.css
www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/ 19 KB
4 KB 35ms
34ms Stylesheet
text/css 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/scaffolding.css
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11b10fdb2a5de2bc29f16503b2ee10492c9441b12e7d1d0248ff764f62a0206d

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Sat, 21 Mar 2020 00:31:04 GMT
server: cloudflare
age: 7668
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
x-reg-bofh: pfy03gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9f2eb0f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 design.css
www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/ 52 KB
11 KB 54ms
53ms Stylesheet
text/css 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/design.css
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 05 Mar 2020 14:40:15 GMT
server: cloudflare
age: 7668
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
x-reg-bofh: pfy02gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9f2eb3f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 _.js Show response
www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/ 207 KB
59 KB 41ms
40ms Script
application/javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95f0b8a588ddfbf5b37b38fcb1e50f745648419e25cc7ee2e503efc3ba93c990

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Mon, 16 Mar 2020 16:05:34 GMT
server: cloudflare
age: 861915
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
x-reg-bofh: pfy02gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9f2eb7f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 44 KB
14 KB 71ms
70ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

ae80c6be45b57cd2ca90ac80afb05116263bce25f85d36628aa7fa6aefc9de69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "467 / 712 of 1000 / last-modified: 1585081375"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 14669
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:04 GMT

GET
H2 200 reg_logo.svg
www.theregister.co.uk/design_picker/fa16d26efb42e6ba1052f1d387470f643c5aa18d/graphics/std/ 15 KB
5 KB 36ms
35ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/fa16d26efb42e6ba1052f1d387470f643c5aa18d/graphics/std/reg_logo.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 363edeba1963685d08a885c613f43fd3c94fa0ba6cea87de6036f960c9d38717

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 26 Sep 2019 14:47:16 GMT
server: cloudflare
age: 12135710
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 57a1ea9f2eb9f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 search.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 609 B
424 B 56ms
56ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 11615031
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 57a1ea9f6f7ff3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 vulture.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 2 KB
883 B 49ms
40ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Fri, 10 Jan 2020 15:10:58 GMT
server: cloudflare
age: 1764004
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc899f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 search.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/ 609 B
394 B 53ms
44ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/search.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 15161777
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc89cf3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 dl.gif
regmedia.co.uk/2016/04/14/ 35 B
185 B 166ms
66ms Image
image/gif 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2016/04/14/dl.gif
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 2004014
cf-polished: origSize=43, status=webp_bigger
cf-ray: 57a1eaa04dc6dfeb-FRA
status: 200
cf-bgj: imgq:85
content-length: 35
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 14 Apr 2016 13:41:38 GMT
server: cloudflare
etag: "2b-530720dc4f2ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy01
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 rect_comment_bubble_white.svg
www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/ 496 B
358 B 50ms
41ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/rect_comment_bubble_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Fri, 10 Jan 2020 15:10:58 GMT
server: cloudflare
age: 2109723
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc89ff3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 reddit.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 1 KB
648 B 63ms
54ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/reddit.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 15149752
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc8a2f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 twitter.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 745 B
468 B 48ms
40ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/twitter.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 15161777
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc8a5f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 facebook.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 311 B
271 B 51ms
42ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/facebook.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Fri, 10 Jan 2020 15:10:58 GMT
server: cloudflare
age: 1492162
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc8a7f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 linkedin_alt.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 363 B
287 B 63ms
54ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_alt.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 10402043
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc8abf3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_illinois_ransomware.jpg
regmedia.co.uk/2020/03/12/ 25 KB
25 KB 144ms
44ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/12/shutterstock_illinois_ransomware.jpg?x=442&y=293&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e099a9372c5c120a9e0ba1136dd283513937bedf9cca34b88300132cf585341c

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 397933
cf-polished: qual=85, origFmt=jpeg, origSize=27689
cf-ray: 57a1eaa04dbfdfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_illinois_ransomware.webp"
cf-bgj: imgq:85
content-length: 25370
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 12 Mar 2020 23:59:55 GMT
server: cloudflare
etag: "6c29-5a0b1264e49f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 ship_shutterstock.jpg
regmedia.co.uk/2017/08/16/ 2 KB
2 KB 149ms
50ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2017/08/16/ship_shutterstock.jpg?x=174&y=115&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b081c8d9b69d7b76779e033f58d9c0f79a254ecce6e2f18db0676090edad3b18

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 64089
cf-polished: qual=85, origFmt=jpeg, origSize=2417
cf-ray: 57a1eaa04dc3dfeb-FRA
status: 200
content-disposition: inline; filename="ship_shutterstock.webp"
cf-bgj: imgq:85
content-length: 2344
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Mon, 03 Feb 2020 11:22:56 GMT
server: cloudflare
etag: "971-59daa2520a696"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy03gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_cloud_uk.jpg
regmedia.co.uk/2019/02/05/ 11 KB
12 KB 139ms
40ms Image
image/jpeg 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2019/02/05/shutterstock_cloud_uk.jpg?x=200&y=200&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee2fd813fd9cfaff970009ec85bd66e78b38691433b25111dfd7e73f9b0bc4bb

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 141265
cf-polished: degrade=85, origSize=12444, status=webp_bigger
cf-ray: 57a1eaa04dd2dfeb-FRA
status: 200
cf-bgj: imgq:85
content-length: 11663
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 24 Mar 2020 14:38:54 GMT
server: cloudflare
etag: "309c-5a19ab60b7ace"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy01gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_cancelled.jpg
regmedia.co.uk/2020/03/24/ 8 KB
9 KB 127ms
28ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/24/shutterstock_cancelled.jpg?x=200&y=200&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c992dd3825c780cdbb4e11ea975fe529efb2dba73309e7d76ab55e938e0f323

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 29928
cf-polished: qual=85, origFmt=jpeg, origSize=10542
cf-ray: 57a1eaa04de4dfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_cancelled.webp"
cf-bgj: imgq:85
content-length: 8588
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 24 Mar 2020 16:31:11 GMT
server: cloudflare
etag: "292e-5a19c4797b07c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_diskwipe.jpg
regmedia.co.uk/2020/03/24/ 4 KB
4 KB 145ms
46ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/24/shutterstock_diskwipe.jpg?x=200&y=200&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d501e93d6f8d633677b0d71b23bd3bc4b7eb31ee5e7c49320218a6b5498cd27

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 58720
cf-polished: qual=85, origFmt=jpeg, origSize=5057
cf-ray: 57a1eaa04de6dfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_diskwipe.webp"
cf-bgj: imgq:85
content-length: 4254
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 25 Mar 2020 23:12:13 GMT
server: cloudflare
etag: "13c1-5a1b5ffa51d2d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy03gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_samurai.jpg
regmedia.co.uk/2020/03/26/ 7 KB
7 KB 54ms
40ms Image
image/jpeg 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/26/shutterstock_samurai.jpg?x=200&y=200&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 508eaa55e9df71fb9daf249826540f803223f1931214ae738fae39ff11b60fe6

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 4726
cf-polished: status=not_needed
cf-ray: 57a1eaa05deadfeb-FRA
status: 200
cf-bgj: imgq:85
content-length: 7015
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 26 Mar 2020 14:12:12 GMT
server: cloudflare
etag: "1b67-5a1c2923d5182"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy03gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 british_library_shelves_st_pancras.jpg
regmedia.co.uk/2015/06/17/ 16 KB
16 KB 50ms
36ms Image
image/jpeg 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2015/06/17/british_library_shelves_st_pancras.jpg?x=200&y=200&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79476979f0dd352eede0c7a570e4c48648367be7d5b97fb5e1363e19f2462885

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 11912
cf-polished: degrade=85, origSize=18826, status=webp_bigger
cf-ray: 57a1eaa05decdfeb-FRA
status: 200
cf-bgj: imgq:85
content-length: 16038
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 26 Mar 2020 12:12:12 GMT
server: cloudflare
etag: "498a-5a1c0e51358fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 vulture_16bits_half.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 7 KB
1 KB 84ms
76ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture_16bits_half.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1bc9eeec7ba19c97ba1d50c10195c3f74302af5e712409e51e5b8d35b6f46eb8

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Tue, 01 Oct 2019 14:16:02 GMT
server: cloudflare
age: 15149752
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc8aff3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_windows.jpg
regmedia.co.uk/2020/03/24/ 7 KB
7 KB 77ms
64ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/24/shutterstock_windows.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d4fe1c2ae3fedac39469ab8a9d0dcd10901e7412f65945f273b5df9208cfdef6

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 111604
cf-polished: qual=85, origFmt=jpeg, origSize=7218
cf-ray: 57a1eaa05deedfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_windows.webp"
cf-bgj: imgq:85
content-length: 6758
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 25 Mar 2020 08:14:55 GMT
server: cloudflare
etag: "1c32-5a1a976a9e94b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy03gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_sick_exec.jpg
regmedia.co.uk/2020/02/27/ 3 KB
3 KB 48ms
35ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/02/27/shutterstock_sick_exec.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc5ac78496578aad5b0b5fb5289c454cff6223c437bb250f9d97296189265d3d

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 2317576
cf-polished: qual=85, origFmt=jpeg, origSize=3905
cf-ray: 57a1eaa05df2dfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_sick_exec.webp"
cf-bgj: imgq:85
content-length: 3310
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Fri, 28 Feb 2020 02:29:10 GMT
server: cloudflare
etag: "f41-59f999a48cdb1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy03gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_coronavirus_map.jpg
regmedia.co.uk/2020/03/17/ 7 KB
7 KB 41ms
28ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/17/shutterstock_coronavirus_map.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dbe8d0a195c111c9e6ce4c4c358324a86eb09eb018a41de488aa472eabefd21

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 617612
cf-polished: qual=85, origFmt=jpeg, origSize=6930
cf-ray: 57a1eaa05df4dfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_coronavirus_map.webp"
cf-bgj: imgq:85
content-length: 6914
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 17 Mar 2020 08:43:03 GMT
server: cloudflare
etag: "1b12-5a108ec84776b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 e32020.jpg
regmedia.co.uk/2020/03/11/ 4 KB
4 KB 49ms
36ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/11/e32020.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a94325ee2b6a330841751fdccb8382830d03faf2bebb53601a023d54d181ee7

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 1201773
cf-polished: qual=85, origFmt=jpeg, origSize=9317
cf-ray: 57a1eaa05dfedfeb-FRA
status: 200
content-disposition: inline; filename="e32020.webp"
cf-bgj: imgq:85
content-length: 4082
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 11 Mar 2020 15:37:12 GMT
server: cloudflare
etag: "2465-5a096029dcc92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 zombiehandgrave.jpg
regmedia.co.uk/2018/05/03/ 5 KB
6 KB 58ms
45ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2018/05/03/zombiehandgrave.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 449bb084a71158da5d9ae64d5cf3c250f5614a0ada0cc4acb47c23dd4e896763

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 1849793
cf-polished: qual=85, origFmt=jpeg, origSize=9056
cf-ray: 57a1eaa05dffdfeb-FRA
status: 200
content-disposition: inline; filename="zombiehandgrave.webp"
cf-bgj: imgq:85
content-length: 5516
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 03 May 2018 15:22:35 GMT
server: cloudflare
etag: "2360-56b4ec5eb08e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 hong_kong_coronavirus_currency.jpg
regmedia.co.uk/2020/03/24/ 9 KB
9 KB 59ms
46ms Image
image/jpeg 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/03/24/hong_kong_coronavirus_currency.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cee965d8588a3964621f712da4c7baed4ef497edba69b63a902a69032efb5101

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 134628
cf-polished: status=not_needed
cf-ray: 57a1eaa05e02dfeb-FRA
status: 200
cf-bgj: imgq:85
content-length: 8742
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Wed, 25 Mar 2020 01:43:35 GMT
server: cloudflare
etag: "2226-5a1a3ff1f7d24"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy02gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 shutterstock_server_room.jpg
regmedia.co.uk/2020/02/10/ 6 KB
6 KB 52ms
39ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2020/02/10/shutterstock_server_room.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a985ced3bed93035de701eb779fbb2da0046ebd48579ec9e908ee46737767d67

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 676216
cf-polished: qual=85, origFmt=jpeg, origSize=6702
cf-ray: 57a1eaa05e04dfeb-FRA
status: 200
content-disposition: inline; filename="shutterstock_server_room.webp"
cf-bgj: imgq:85
content-length: 6416
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 17 Mar 2020 11:46:50 GMT
server: cloudflare
etag: "1a2e-5a10b7dca4c12"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy01gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 windows_xp_professional_loading_screen.jpg
regmedia.co.uk/2017/06/27/ 2 KB
2 KB 58ms
45ms Image
image/webp 2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2017/06/27/windows_xp_professional_loading_screen.jpg?x=198&y=131&crop=1
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea9766ee93dea33e983794ed004d0b336dbcdd33383da07e011faaa1f1875b42

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 1964557
cf-polished: qual=85, origFmt=jpeg, origSize=2445
cf-ray: 57a1eaa05e05dfeb-FRA
status: 200
content-disposition: inline; filename="windows_xp_professional_loading_screen.webp"
cf-bgj: imgq:85
content-length: 2216
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Sun, 14 Oct 2018 02:21:38 GMT
server: cloudflare
etag: "98d-57826faf78898"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy01gb
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 whitepaper_book.png
www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/ 1 KB
1 KB 49ms
42ms Image
image/png 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/whitepaper_book.png
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 10746783
cf-ray: 57a1ea9fc8b3f3eb-LHR
status: 200
content-length: 1119
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Fri, 17 Feb 2017 15:08:14 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy01
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 footer_mob_nav_arrow_black.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 331 B
268 B 45ms
39ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_black.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 15161777
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fc8b5f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 sitpub_footer.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 8 KB
3 KB 92ms
85ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/sitpub_footer.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 10989150
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fd8edf3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 footer_mob_nav_arrow_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 328 B
267 B 84ms
78ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Fri, 10 Jan 2020 15:10:58 GMT
server: cloudflare
age: 806314
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy03gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fd8f4f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 linkedin_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 371 B
291 B 84ms
77ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_white.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Fri, 10 Jan 2020 15:10:58 GMT
server: cloudflare
age: 2195898
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy02gb
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fd8f7f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 rss.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 400 B
327 B 88ms
82ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/rss.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 23113010
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
cf-ray: 57a1ea9fd8f9f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 / Show response
nir.theregister.co.uk/ 144 B
666 B 95ms
84ms Script
application/x-javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nir.theregister.co.uk/?g=vk&g=c&g=sa&g=vvfc&s=c/sec.front&s=vk/malware&s=vk/coronavirus&s=vk/hacking&s=vk/ransomware&s=vvfc/6b2938ed106729c71e35884fc3f9730d&s=vvfc/6b2938ed106729c71e35884fc3f9730d&s=vvfc/6b2938ed106729c71e35884fc3f9730d
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60a778c309adcbb2ab55da2dca559f33b2a4d42e63ff63938d64d235fdd695db

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 57a1ea9fd8fcf3eb-LHR
content-type: application/x-javascript
status: 200
cache-control: no-cache
x-reg-bofh: pfy01gb
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 arimo-400.latin.woff2
www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/ 26 KB
26 KB 73ms
71ms Font
font/woff2 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-400.latin.woff2
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9

Request headers

Referer: https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/scaffolding.css
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 1504759
status: 200
content-length: 26144
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 04 Feb 2020 15:35:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: https://www.theregister.co.uk
x-reg-bofh: pfy03gb
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 57a1ea9fd900f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 arimo-700.latin.woff2
www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/ 25 KB
25 KB 72ms
72ms Font
font/woff2 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-700.latin.woff2
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a

Request headers

Referer: https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/scaffolding.css
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 4405282
status: 200
content-length: 25628
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Tue, 04 Feb 2020 15:35:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: https://www.theregister.co.uk
x-reg-bofh: pfy01gb
cache-control: public, max-age=33696000
accept-ranges: bytes
cf-ray: 57a1ea9fd902f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 promo_unit_arrow.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 248 B
250 B 97ms
34ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/promo_unit_arrow.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed

Request headers

Referer: https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/design.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 24 Aug 2017 14:00:39 GMT
server: cloudflare
age: 33546440
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy04
cache-control: public, max-age=33696000
cf-ray: 57a1eaa05a50f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 109 B
839 B 81ms
24ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.theregister.co.uk

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 33ms
14ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.theregister.co.uk

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020032301.js Show response
securepubads.g.doubleclick.net/gpt/ 167 KB
61 KB 92ms
73ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Mar 2020 17:22:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 62290
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:04 GMT

GET
H2 200 envelope.svg
www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/ 454 B
417 B 48ms
30ms Image
image/svg+xml 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/envelope.svg
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: br
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: HIT
last-modified: Thu, 09 Aug 2018 12:44:14 GMT
server: cloudflare
age: 10402043
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-reg-bofh: pfy01
cache-control: public, max-age=33696000
cf-ray: 57a1eaa05a53f3eb-LHR
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H/1.1 200
OK outbrain.js Show response
widgets.outbrain.com/ 127 KB
43 KB 591ms
495ms Script
application/x-javascript 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 15:31:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2020 08:30:47 GMT
ETag: W/"1fbb3-KoHnezOYyT0SUusJEB8aDSXQE/s"
Vary: Accept-Encoding
Edge-Cache-Tag: widget-cheetah
Content-Type: application/x-javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,POST
Connection: keep-alive, Transfer-Encoding
Access-Control-Allow-Credentials: false
Timing-Allow-Origin: *

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 23ms
5ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 3149
date: Thu, 26 Mar 2020 14:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Thu, 26 Mar 2020 16:38:35 GMT

GET
H2 200 admtracker.lib.min.js Show response
pj.l.admedo.com/ 6 KB
3 KB 142ms
32ms Script
application/javascript 13.224.194.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pj.l.admedo.com/admtracker.lib.min.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-122.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8db699e718814dce4d71b8c7d981df5aed9df3d3b49eb5d8970c3f75c2547ad

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:27:33 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 16:09:45 GMT
server: AmazonS3
age: 212
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public,max-age=900
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: urrZMSvkYRFQAP9EI9iTpRzxcmcZq2OdKE0N2sdn8m9C4Cw_ti4Nww==
via: 1.1 9e62923882d737ac8cd27f0d1b1c24cf.cloudfront.net (CloudFront)

GET
H2 200 collect
www.google-analytics.com/ 35 B
110 B 11ms
10ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&aip=1&a=110277289&t=pageview&_s=1&dl=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F12%2Fransomware_illinois_health%2F&ul=en-us&de=UTF-8&dt=Fresh%20virus%20misery%20for%20Illinois%3A%20Public%20health%20agency%20taken%20down%20by...%20web%20ransomware.%20Great%20timing%2C%20scumbags%20%E2%80%A2%20The%20Register&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&exp=A_aVnslITyK8U4soe88Piw.0&_u=YGBAiAABB~&jid=172247186&gjid=1542511278&cid=464137936.1585236665&tid=UA-33330076-1&_gid=1235985434.1585236665&cd2=Shaun%20Nichols&cd3=&cd4=www%20story&cd5=news&cd8=none&cd9=&cd10=&z=609996359

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 30 Jan 2020 03:41:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 4880957
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&gjid=1542511278&_gid=1235985434.1585236665&_u=YGBAiAABB~&z=2010034508
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&_v=j81&z=2010034508
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&_v=j81&z=2010034508&slf_rd=1&random=2681409907

42 B
109 B

17ms
17ms

Image
image/gif

2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&_v=j81&z=2010034508&slf_rd=1&random=2681409907

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:04 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=464137936.1585236665&jid=172247186&_v=j81&z=2010034508&slf_rd=1&random=2681409907
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads.js Show response
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ 27 B
137 B 57ms
56ms XHR
application/javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
cf-cache-status: HIT
age: 14718664
cf-ray: 57a1eaa17e9af3eb-LHR
status: 200
content-length: 27
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 05 Apr 2018 12:48:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy04
expires: Tue, 20 Apr 2021 15:31:04 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 72 KB
12 KB 520ms
519ms XHR
text/plain 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3387627700450064&correlator=2538304866650514&output=ldjh&impl=fifs&adsid=NT&eid=21065763%2C21062888%2C21063204%2C21064169%2C21065516&vrg=2020032301&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=6978%2Creg_security%2Cfront&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C970x91%7C970x90%7C970x250%7C970x251%7C728x90%7C728x91%7C468x60%7C468x61%2C970x250%7C970x90%7C728x90%7C468x60%2C300x1050%7C300x600%7C300x250%7C300x252%2C300x601%7C300x250%7C300x251%7C300x100%7C300x50%2C300x250%7C300x1%7C300x50&ists=32&prev_scp=pos%3Dtop%26raptor%3Dkite%26unitnum%3D1%7Cpos%3Dtop%26raptor%3Dcondor%26unitnum%3D2%7Cpos%3Dbtm%26raptor%3Dhawk%26unitnum%3D3%7Cpos%3Dtop%26raptor%3Deagle%26unitnum%3D4%7Cpos%3Dmid%26raptor%3Dfalcon%26unitnum%3D5%7Cpos%3Dbtm%26raptor%3Dowl%26unitnum%3D6&cust_params=test%3D0%26protocol%3Dhttps%253A%26li%3Dnull%26uid%3Dnull%26sc%3D1%26bwidth%3D15%26bheight%3D12%26orientation%3Dlandscape%26mm_segments%3Dwd14916%252Cwd15295%252Cwd15434%26pid%3D207467%26pt%3Da%26axc%3Dnull%26kw%3Dmalware%252Ccoronavirus%252Chacking%252Cransomware%26cat%3Dnews%26tag%3Dnull%26author%3DShaun%252520Nichols%26year%3D2020%26nsfw%3Dnull%26vid%3Dnull%26ct%3Ds-async%26vc%3Dsec.front%26sa%3D%26vk%3Dransomware%252Ccoronavirus%252Cmalware%252Chacking&cookie_enabled=1&bc=31&abxe=1&lmt=1585236664&dt=1585236664572&dlt=1585236664173&idt=365&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C308%2C293%2C978%2C978%2C331&adys=-12245933%2C129%2C2762%2C234%2C2073%2C4032&adks=1331772189%2C284626583%2C1390360203%2C2610646818%2C8582313%2C3059020159&ucis=1%7C2%7C3%7C4%7C5%7C6&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F12%2Fransomware_illinois_health%2F&dssz=27&icsg=15008&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x4627%7C1000x4627%7C1000x279%7C315x2460%7C315x2460%7C924x1256&msz=1x1%7C1000x105%7C1000x278%7C300x1050%7C300x601%7C924x250&ga_vid=464137936.1585236665&ga_sid=1585236665&ga_hid=110277289&fws=132%2C4%2C4%2C4%2C4%2C4&ohw=1000%2C1000%2C1000%2C1000%2C1000%2C1000

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

765d97dbbba2fe7a092ed1d30b13d8ae57f44be6756eeea2b30b75447f7cd324

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 11522
x-xss-protection: 0
google-lineitem-id: 61995219,5328295094,5329618998,5328286037,5321539816,5327097831
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 35665517499,138307347721,138307041493,138307000034,138305596220,138306960551
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.theregister.co.uk
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020032301.js Show response
securepubads.g.doubleclick.net/gpt/ 67 KB
25 KB 74ms
74ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Mar 2020 17:22:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25048
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:04 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H/1.1 200
OK Cookie set put.html
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame EF25 0
0 30ms
29ms Document
text/html 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Host: widgets.outbrain.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "c0311cf15c21ddda054005e92fad3f9e:1585128557.048626"
Last-Modified: Wed, 25 Mar 2020 08:30:07 GMT
Server: AkamaiNetStorage
Content-Length: 416
Cache-Control: max-age=604800
Date: Thu, 26 Mar 2020 15:31:05 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Set-Cookie: akacd_widgets_routing=1585236665~rv=33~id=5329adaf5079dea35d84818a077164f0; path=/; Expires=Thu, 26 Mar 2020 15:31:05 GMT; Secure; SameSite=None

GET
H/1.1 200
OK d3d3LnRoZXJlZ2lzdGVyLmNvLnVr Show response
tcheck.outbrainimg.com/tcheck/check/ 15 B
475 B 93ms
31ms XHR
application/json 95.101.186.38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://tcheck.outbrainimg.com/tcheck/check/d3d3LnRoZXJlZ2lzdGVyLmNvLnVr

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.186.38 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a95-101-186-38.deploy.static.akamaitechnologies.com

Software

Resource Hash

39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains;
ETag: W/"f-ayLlCL3PuzXSThdu78iReSEjl6Y"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=35981
Date: Thu, 26 Mar 2020 15:31:05 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: false
Content-Length: 15
Expires: Fri, 27 Mar 2020 01:30:46 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
27 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28015
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 / Show response
nir.theregister.co.uk/ 0
152 B 47ms
47ms Script
application/x-javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nir.theregister.co.uk/?s=sa/oid.102962979
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:05 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 57a1eaa50815f3eb-LHR
content-type: application/x-javascript
status: 200
cache-control: no-cache
x-reg-bofh: pfy01gb
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame 7AFB 200 KB
55 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame 7AFB 200 KB
55 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame 7AFB 92 KB
28 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2691
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28328
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f4788313c10056ed"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:14 GMT

GET
DATA 200
OK truncated
/ Frame 7AFB 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: da1d90e854ff635bba337e2406bb42bbaffc6992601e8c281a536aa6fb91c5df

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ 20 KB
7 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2639
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 7178
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:47:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9d3d923337ef7e9b"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:47:06 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame B91F 200 KB
55 KB 10ms
5ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame B91F 200 KB
55 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame B91F 92 KB
28 KB 9ms
4ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2691
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28328
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f4788313c10056ed"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:14 GMT

GET
DATA 200
OK truncated
/ Frame B91F 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e1c1a43a151d1d5efd2c2c6c39a8c18f661c6681accf2ca7d014eb408364089

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame F053 200 KB
55 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame F053 200 KB
55 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame F053 92 KB
28 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2691
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28328
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f4788313c10056ed"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:14 GMT

GET
DATA 200
OK truncated
/ Frame F053 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f49e029dc83f0fb71c9c27b0ffc6bacf534bfe19493c0372464e3c350c8c81d7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame DF68 200 KB
55 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012003101714470/ Frame DF68 200 KB
55 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2677
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55811
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "789295de90cb321e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:28 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012003101714470/v0/ Frame DF68 92 KB
28 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 2691
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28328
x-xss-protection: 0
server: sffe
date: Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f4788313c10056ed"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 14:46:14 GMT

GET
DATA 200
OK truncated
/ Frame DF68 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e828d9afc61e11f2e9c94df1fe9f29697bc35c6b6c96380d0cdddefc1ac1a71

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame DE81 0
0 86ms
71ms Fetch
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstUCWxfkRZ-lP989yixhBImC5ZVjQVp1-f9xbLpXjaP7dJjDjHL-YCfE4cCUTsdUwFZVBhCqdYo2UjIcBOSeaEJPBvIHbej_eRJSYCgztj_qwr4DzBLZoUIWcwh3rwoSeNaxrzGUubEx-l5bmHPCYUTN54sH60y7aQ-yco0W7_myQiTY0gNGddObSVX9MlxKC9niqhcFezuQhVKp44dcOJcGhp_iGQbCZjiTV7m8TzVYMjjrIjCZN92IgiPMMmo_suU6uF0WWkkKHKjUzbWU2l-Xg&sai=AMfl-YRxfPUh9EI_UWYjisrKnojEQIm453zpaV2O0XjtMfK4X6Uvoqwh6P-Ty-xv4BF1s3vvs_fK-gIuu5JkgMbbCQmHyGTV-JGL-OP1rC6q&sig=Cg0ArKJSzJi_iX5vgJaJEAE&urlfix=1&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame DE81 74 KB
28 KB 54ms
39ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1585165059237800"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28264
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 10453683364730994797
tpc.googlesyndication.com/simgad/ Frame 7AFB 55 KB
55 KB 21ms
9ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10453683364730994797

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d7c425ec702acde775f613749c0ffdea537ca0954df1a07b8f2a9fb36fffabc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:03:08 GMT
x-content-type-options: nosniff
age: 1677
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55886
x-xss-protection: 0
last-modified: Tue, 24 Mar 2020 12:09:28 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 15:03:08 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7AFB 0
290 B 84ms
73ms Image
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPN3U2TXLu-Lf7rAvqvEmu-Kmw8n7wwIj6JE2C9Ozwm73m2cSo28bb3XszhW9SNCzaDJtzDzxSs_OoBbVq_TukXrrQE19L_-_ikHpHpjPj7WS17UhAebR_u5xxGgsSwznRykVwr1Oko2XL2a1rovQzieWN5nlJyzKf882BkpNVURNOwfGnqSK2y8LO5VHF3IQjskNoSL8fLY3O4tFllB5d5eBAUqXyH8H01Y4_kwVxhoFLvdoIlrdvG_ePEmFZyRtbK5QhXwKAzmo6OBoSiwpkJw&sai=AMfl-YS85hXiy3vEhyYyeiIaJnEqDCLZ5l2f5vNpucI0xM9atPtVAGnan9lrIBqImSjEUT1MQHyWTLcm5bTpmXW-75wBNF-ZRUG9NNwO8QPv&sig=Cg0ArKJSzHyPYCpECPe-EAE&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 / Show response
nir.theregister.co.uk/ 0
136 B 57ms
45ms Script
application/x-javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nir.theregister.co.uk/?s=sa/oid.2678069889
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:05 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 57a1eaa5690ff3eb-LHR
content-type: application/x-javascript
status: 200
cache-control: no-cache
x-reg-bofh: pfy02gb
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
nir.theregister.co.uk/ 0
128 B 60ms
48ms Script
application/x-javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nir.theregister.co.uk/?s=sa/oid.2424853138
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:05 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 57a1eaa56915f3eb-LHR
content-type: application/x-javascript
status: 200
cache-control: no-cache
x-reg-bofh: pfy01gb
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 1276104633831866114
tpc.googlesyndication.com/simgad/ Frame B91F 80 KB
80 KB 20ms
10ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1276104633831866114

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

120ce55883f26d68e2108231d7f0c6e772e186d2b9e6a4cf72cc6c75bc973e54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 19 Mar 2020 15:57:42 GMT
x-content-type-options: nosniff
age: 603203
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 81508
x-xss-protection: 0
last-modified: Thu, 19 Mar 2020 15:20:58 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Mar 2021 15:57:42 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame B91F 0
290 B 78ms
73ms Image
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssIGvYV7Q7_2EJ1kWyD7pGxBATbDCRtIqAt3GELc39aBhzp5Q8e-qg9GW3GMaSkbrdQ6wLWYJ1r66_uW-iOtC7txmzNQmfJASRj01PXQNKEIr9rHuVvBED0XzdIqOJHEzcX_r0SD1-EYfuDmIoCpsYQFIpZHk4fngC1vK-e3ZtuYwU_pbIQRTUL6AXJ39r6Z18HqrG8-9cdUAZXf4Y2O3maKl2XKJsNLiUZd_DdkY2vwEugk7uhyN-pGK4ts9mFVbjVDKJS0o7tDlS9ISzw&sai=AMfl-YTtoBDIfSUmv9AHuVyAKy2WcM4g02lIT4WNXBvryK8OL3QWkmemKEEjsEKXKjL1nM1mJy-dY9Kx96vr3zoAGScgrMGckV3AuCw0jGxE&sig=Cg0ArKJSzK_zRwd1cY8SEAE&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 17065325894927324648
tpc.googlesyndication.com/simgad/ Frame F053 56 KB
56 KB 61ms
57ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17065325894927324648

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45e29fe553dec49ecfc954397433161ad73fd261b065cde97d8ae8171bd9c765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
last-modified: Tue, 24 Mar 2020 16:48:31 GMT
server: sffe
access-control-allow-origin: *
x-dns-prefetch-control: off
content-type: image/jpeg
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 57654
x-xss-protection: 0
expires: Fri, 26 Mar 2021 15:31:05 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame F053 0
291 B 75ms
73ms Image
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskQgiizy8kzgJ76vfy_Z0u06bhgnN_DZIUDUAClGLE46oziwgy9QPzNTlnAYV444jjRNeah_AoPZs4MXAAmIAjj4YhML7TxwpItRbrkqt8ClgEtVes54ZFhcJc2sG2qpI_I77Hr4870KoWmMNJRM8TWrlYPUF82aifY45RYqiQafg7JgbqwFsVXV6m8nBJrt5_nZCvdlZGRFIidGi_wACGlHkZqUifS4cen39L2f-2kVQv8c5VYiOAZM1CtpJFE-iWJbP0ZxWbwuoYtELxiyeJoQ&sai=AMfl-YSnutQFk6_eYn5akbSpGpx531mkGoauIxWd0QXPZoPEZHkdE3PkLDbcQN2qdGeO9rtOy7JvIZCithiOajzwqVIf_-LmWRSAJWGS6xj3&sig=Cg0ArKJSzMZTSPHiKXdbEAE&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 10196342649340698821
tpc.googlesyndication.com/simgad/ Frame DF68 81 KB
81 KB 22ms
20ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10196342649340698821

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

615d3776c617108f0603964f782f5f0ef6ee0037a2be5a575066c337302b7e8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 10 Mar 2020 22:42:58 GMT
x-content-type-options: nosniff
age: 1356487
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 82993
x-xss-protection: 0
last-modified: Fri, 06 Mar 2020 16:52:39 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Mar 2021 22:42:58 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame DF68 0
282 B 75ms
74ms Image
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJGAr8H9plwgM0KBsGj0E9q9X5MNLoUFbprl7X_NCTwEd3-ZlO1zzVAp1B6xVt9apa4xVv02bijYbd0yvuvu6n06wRjJ4TjwvksBiOmqMK1AsRHLIkaeMGm0XpFQnS7Wrsr1O5M8L-3mBf4IXJTqEU9PbxNM0b-9dwOq1TmvZvxjey2_fkH1yhVgltjNlbhQfdBqNzEysfuyJ326bMm9PYVhYGnHbju-FsBXxBJHojsgQETQJOgqgy0lULYkht8Y9N7lpyFqZCT0wLXrze&sai=AMfl-YRHFW-Uqw2g1nL0Fdl5WksjcKZ6hKmmY2KASLoweirmcEWlDpyc2yGXjVxomOsPC_kfrN7x-r_BwDiYXjVu96dWK1EyK0mBccAlTelR&sig=Cg0ArKJSzEDtGhBPpiwNEAE&adurl=

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:05 GMT

GET
H2 200 placement_invocation Show response
ob.cheqzone.com/ 38 KB
15 KB 1357ms
90ms Script
text/javascript 2a02:6ea0:c710::2
CDN77

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c710::2 , Germany, ASN60068 (CDN77, GB),
Reverse DNS
Software: BunnyCDN-DE1-487 /
Resource Hash: f677040712955dc4fc8e9f792849a092501ffec68788837915d8ff8ff7b0d1e2

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:06 GMT
content-encoding: br
server: BunnyCDN-DE1-487
vary: Accept-Encoding
cdn-edgestorageid: 487
content-type: text/javascript; charset=utf-8
status: 200
cdn-uid: 2642aeaf-0ebf-4c43-9f87-c153981605b2
cache-control: public, max-age=43200
cdn-pullzone: 62714
cdn-cachedat: 2020-02-26 15:49:38
cdn-requestid: e2176d68f77bd57c21ad41de621b2bc8
cdn-requestcountrycode: DE
cdn-cache: HIT

GET
DATA 200
OK truncated
/ Frame DE81 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5deb2c6e3a3a0be160b1b098aee1ccc3f4a210788b58e6a7886e0a53d2c3b49c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 10453683364730994797
tpc.googlesyndication.com/simgad/ Frame 7AFB 55 KB
55 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10453683364730994797

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d7c425ec702acde775f613749c0ffdea537ca0954df1a07b8f2a9fb36fffabc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:03:08 GMT
x-content-type-options: nosniff
age: 1677
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 55886
x-xss-protection: 0
last-modified: Tue, 24 Mar 2020 12:09:28 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 15:03:08 GMT

GET
H2 200 1276104633831866114
tpc.googlesyndication.com/simgad/ Frame B91F 80 KB
80 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1276104633831866114

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

120ce55883f26d68e2108231d7f0c6e772e186d2b9e6a4cf72cc6c75bc973e54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 19 Mar 2020 15:57:42 GMT
x-content-type-options: nosniff
age: 603203
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 81508
x-xss-protection: 0
last-modified: Thu, 19 Mar 2020 15:20:58 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Mar 2021 15:57:42 GMT

GET
H2 200 17065325894927324648
tpc.googlesyndication.com/simgad/ Frame F053 56 KB
56 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17065325894927324648

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45e29fe553dec49ecfc954397433161ad73fd261b065cde97d8ae8171bd9c765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 57654
x-xss-protection: 0
last-modified: Tue, 24 Mar 2020 16:48:31 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Mar 2021 15:31:05 GMT

GET
H2 200 10196342649340698821
tpc.googlesyndication.com/simgad/ Frame DF68 81 KB
81 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10196342649340698821

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

615d3776c617108f0603964f782f5f0ef6ee0037a2be5a575066c337302b7e8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 10 Mar 2020 22:42:58 GMT
x-content-type-options: nosniff
age: 1356487
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 82993
x-xss-protection: 0
last-modified: Fri, 06 Mar 2020 16:52:39 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Mar 2021 22:42:58 GMT

GET
H2

200

tp.gif
regmedia.co.uk/2007/09/13/
Redirect Chain

https://go.theregister.co.uk/k/abt_a
https://regmedia.co.uk/2007/09/13/tp.gif

34 B
485 B

66ms
65ms

Image
image/webp

2606:4700::6810:5351
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://regmedia.co.uk/2007/09/13/tp.gif
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 15:31:05 GMT
cf-cache-status: HIT
age: 677586
cf-polished: origFmt=gif, origSize=49
cf-ray: 57a1eaa8ae4ddfeb-FRA
status: 200
content-disposition: inline; filename="tp.webp"
cf-bgj: imgq:85
content-length: 34
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 13 Sep 2007 11:17:03 GMT
server: cloudflare
etag: "31-43a027a4c29c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy03gb
expires: Tue, 20 Apr 2021 15:31:05 GMT

Redirect headers

cf-ray: 57a1eaa8285bf3eb-LHR
date: Thu, 26 Mar 2020 15:31:05 GMT
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://regmedia.co.uk/2007/09/13/tp.gif
content-type: text/html; charset=iso-8859-1
status: 302
x-reg-bofh: pfy02gb
content-length: 310

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 342ms
85ms XHR
application/json 70.42.32.31
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585236665669&sessionId=323447cb-ccf1-18b3-ba73-f36d6aad8e5d&url=www.theregister.co.uk&cheqSource=1&cheqEvent=0&exitReason=3
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 15:31:05 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 410e21ab72ea9b19d88fca43dc11669e
Content-Length: 4
Expires: 0

GET
H2 200 get Show response
odb.outbrain.com/utils/ 3 KB
2 KB 198ms
133ms Script
text/x-json 151.101.14.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F12%2Fransomware_illinois_health%2F&srcUrl=https%3A%2F%2Fwww.theregister.co.uk%2Fheadlines.atom&settings=true&recs=true&widgetJSId=GS_1&key=NANOWDGT01&idx=0&version=1050170&apv=false&sig=FaLp0XeF&format=html&va=true&rand=31661&pdobuid=-1&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&clid=323447cb-ccf1-18b3-ba73-f36d6aad8e5d&fdu=www.theregister.co.uk&secured=true&cmpStat=0&ccpaStat=0&ref=&px=330&py=3407&vpd=2207

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d0291ac5ec4df132e81a707bbfd0c1d0e5e64c543a7a14091c7a91000a407bdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=0; includeSubDomains;
content-encoding: gzip
traffic-path: NYDC1, JFK, FRA, Europe1
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status: 200
x-traceid: 459f63c20fdd929c3c9a162d169209c
content-length: 1471
x-served-by: cache-jfk8120-JFK, cache-fra19124-FRA
pragma: no-cache
x-timer: S1585236666.750204,VS0,VE103
date: Thu, 26 Mar 2020 15:31:05 GMT
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
via: 1.1 varnish, 1.1 varnish
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache
backend-ip: 104.156.90.20
accept-ranges: bytes, bytes
x-cache-hits: 0, 0

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 224ms
85ms XHR
application/json 70.42.32.31
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=12f060513251b5401aca70d7f15b54a2&pvId=12f060513251b5401aca70d7f15b54a2&sid=7989&pid=28775&idx=0&wId=829&pad=0&org=0&tm=840&eT=0&widgetWidth=924&widgetHeight=0&widgetX=331&widgetY=3407&tpcs=0&wRV=1050170&pVis=0&lsd=925a627d-9d57-4645-be52-a5c808ff9a97&eIdx=&cheq=2&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 15:31:06 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 993a82e54b13e41d7dcac6c043aa765f
Content-Length: 4
Expires: 0

GET
H/1.1 200
OK Cookie set obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame A6CE 0
0 30ms
29ms Document
text/html 95.101.185.159
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.185.159 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a95-101-185-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Host: widgets.outbrain.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: obuid=925a627d-9d57-4645-be52-a5c808ff9a97
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Response headers

Accept-Ranges: bytes
Content-Type: text/html
ETag: "938505833703786e7ccfce1fecf1cd66:1582216491.628225"
Last-Modified: Thu, 20 Feb 2020 16:34:45 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=604800
Date: Thu, 26 Mar 2020 15:31:05 GMT
Content-Length: 3518
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Set-Cookie: akacd_widgets_routing=1585236665~rv=66~id=7d41bbf2538f0217beee59c0a465b7eb; path=/; Expires=Thu, 26 Mar 2020 15:31:05 GMT; Secure; SameSite=None

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7AFB 42 B
110 B 16ms
16ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvN9912NxpPOLf9nW5bICgKuaXZxjC9KtGMGykuha-4Un4PtiN7G64uxQcLbzGUeGEmmnMrsNd34q6Ca1S0ZJ61vEJoaj4oQqMQ-K1LTIA&sig=Cg0ArKJSzLke86d4htlFEAE&id=ampim&o=308,129&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=209&tls=1209&g=100&h=100&tt=1210&r=v&adk=284626583&avms=ampa

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F053 42 B
110 B 16ms
15ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvuyzLXZp0mTb6lW2KV0X0Eph6wtiaLbYQT9nOplWDcJrjhWdOsnqeI73lLfj41sDZum0F-5IFGjd0IRWZ9ASj_DIIROIsLrPj68ieuZOM&sig=Cg0ArKJSzBjOPn8K6FBwEAE&id=ampim&o=978,393&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1003&mtos=0,0,1003,1003,1003&tos=0,0,1003,0,0&tfs=166&tls=1169&g=100&h=100&tt=1169&r=v&adk=2610646818&avms=ampa

Requested by

Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show_pla Show response
obs.cheqzone.com/ 1 KB
1 KB 308ms
103ms Script
text/javascript 34.232.73.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.cheqzone.com/show_pla?id=65349&url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F12%2Fransomware_illinois_health%2F&sf=0&k=&idx=0&ch=&ext=&np=linux%20x86_64&nv=google%20inc.&rand=845579801530215652725726402070181408698125822121&nc=0&tsf=0&tsfmi=&pv=0&cb=1585236666578&ref=&pit=1&hl=2&op=0&fs=1600x1200&ss=1600x1200&pre=0&jsonp=OBR.extern.onCheqResponse&mr=&ag=438074594&at=&bid=e30%3D&di=W1sxMiwie1wiZVwiOjAsXCJ3Z2xcIjoxfSJdLFstMSwiLSJdLFstMiwiNixtMmhUczJoaGliM2d5%0D%0AaFkwcEk2TDBFQ0NVQkFvRWtKTWdmQ1QwSkJEQzloaFpxS0tFSFRNY0JiTnh0dVRmMWV0dnVUdjJm%0D%0AdVpMQUVGTC82MGRhYnBHTTUreVpjODQ3N3d5Qy8rIl0sWy0zLCJbXSJdLFstNCwiLSJdLFstNSwi%0D%0ALSJdLFstNiwie1wid1wiOltcIlJlZ1pvb3RcIixcIlJlZ0NDXCIsXCJSZWdQYWdlVHlwZVwiLFwi%0D%0AUmVnVHJ1ZVBhZ2VUeXBlXCIsXCJSZWdBcnRpY2xlXCIsXCJzcHJpbnRmXCIsXCJSZWdVdGlsc1wi%0D%0ALFwiUmVnQ0JXXCIsXCJfUmVnQ0JXVGVzdFwiLFwiUmVnQ0JXQVwiLFwiUmVnQ0JXVFwiLFwiaXNf%0D%0Acm93c19iYXNlZF9wYWdlXCIsXCJhZHNfc3RhdGVzX3RyYWNraW5nXCIsXCJSZWdBU1RcIixcInRy%0D%0AYWNrX2FidFwiLFwiZ3B0X2pzX2Vycm9yZWRcIixcImJpcmRfYWx0ZXJuYXRpdmVcIixcImluaXRf%0D%0AZ3B0XCIsXCJhZF9mcmVlXCIsXCJzaG93X2FydGljbGVfc2lnbnVwX21sXCIsXCJSZWdUTFJvdGF0%0D%0AZVwiLFwibG9hZF9tZWRpYV9wbGF5ZXJcIixcInBpdm90X3NodWZmbGVcIixcInBpdm90X2Fyb3Vu%0D%0AZFwiLFwiZGlzcGxheV9zb2NpYWxfcG9wdXBcIixcInJlZ3RsZFwiLFwiZ2V0RWxlbWVudENzc1wi%0D%0ALFwic2V0RWxlbWVudENzc1wiLFwiZ2V0RWxlbWVudEhlaWdodFwiLFwibW92ZUVsZW1lbnRcIixc%0D%0AImFjY291bnRfZm9ybV9jaGVja1wiLFwiZ2V0X2Vwb2NoXCIsXCJyb2xsaW5nX3RpbWVcIixcInRp%0D%0AbWVfY2FsY1wiLFwiZ2V0X3VybF9wYXJhbVwiLFwicmVnX25sX2Zvcm1cIixcInNjYWxlX2FydGlj%0D%0AbGVfaW5uZXJfZWxlbXNcIixcInRvZ2dsZV9hY2NvdW50X3RhYl9zdGF0ZVwiLFwicmVzaXplX2lt%0D%0AZ191cmxcIixcInNlbmRfdG9fYW5hbHl0aWNzXCIsXCJOT19ERVZfQ09PS0lFXCIsXCJpc1Njcm9s%0D%0AbGVkSW50b1ZpZXdcIixcImNoZWNrX3Joc19zdGlja3lfYWRzX2dlbmVyYWxfY29uZGl0aW9uc1wi%0D%0ALFwicmhzX3N0aWNreV9hZF9tdTFfc3BvdFwiLFwiaXNJRVwiLFwic3Bhd25fYW5kX2xvYWRfaW1n%0D%0AX2Zyb21fZGl2XCIsXCJzdGlja3lfYWRfUlRfMkZcIixcInJoc19zdGlja3lfYWRfYnRuX3Nwb3Rc%0D%0AIixcImF1Z21lbnRfcHJvbW9fdW5pdFwiLFwic29jaWFsX2J1dHRvbl9zaGFyZVwiXSxcIm5cIjpb%0D%0AXSxcImRcIjpbXX0iXSxbLTcsIi0iXSxbLTgsIi0iXSxbLTksIi0iXSxbLTEwLCItIl0sWy0xMSwi%0D%0Ae1widFwiOlwiXCIsXCJtXCI6W1wib2c6dGl0bGVcIixcIm9nOmRlc2NyaXB0aW9uXCIsXCJuZXdz%0D%0AX2tleXdvcmRzXCJdfSJdLFstMTIsIm51bGwiXSxbLTEzLCItIl0sWy0xNCwie1wib1wiOjAuMDE0%0D%0AODE0ODE0ODE0ODE0ODE1fSJdLFstMTUsIi0iXSxbLTE2LCIwIl0sWy0xNywiMTYiXSxbLTE4LCJb%0D%0AMCwwLDAsMV0iXSxbLTE5LCJbMCwwLDAsMCwwLDAsMSwyNCwyNCxcIi1cIiwxNjAwLDEyMDAsMTYw%0D%0AMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyMDBdIl0sWy0yMCwiNDY0MTM3OTM2LjE1ODUyMzY2NjUi%0D%0AXSxbLTIxLCJGYUxwMFhlRiJdLFstMjIsIltcIm5cIixcIm5cIl0iXSxbLTIzLCIrIl0sWy0yNCwi%0D%0AW10iXSxbLTI1LCItIl0sWy0yNiwie1widGpoc1wiOjE1NTY1MDk4LFwidWpoc1wiOjEzNDIyNTM0%0D%0ALFwiamhzbFwiOjQyOTQ3MDUxNTJ9Il0sWy0yNywiWzAsMTAsMCxcIjRnXCJdIl0sWy0yOCwiZW4t%0D%0AVVMiXSxbLTI5LCJ7XCJ2XCI6WzIsMiwyLDIsMCwwLDAsMiwwLDIsMCwyLDAsMCwyLDIsMiwyXX0i%0D%0AXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTMxLCJ0cnVlIl0sWy0zMiwiMSJdLFstMzMsIi0iXSxbLTM0%0D%0ALCItIl1d&tsfu=&fst=1600x1200&dep=0&cpos=%5B%7B%22x%22%3A330%2C%22y%22%3A3407%2C%22w%22%3A924%2C%22h%22%3A0%7D%2C%7B%22w%22%3A1600%2C%22h%22%3A1200%7D%5D&ver=24&cri=D4DTYvAAir&sdd=%7B%7D&pto=2566
Requested by: Host: ob.cheqzone.com
URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.232.73.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-73-12.compute-1.amazonaws.com
Software: /
Resource Hash: 1ffdf58d2fdec024c3897183feb54fabdcccf8fd75c4bb8fff3b9ab1e0f1f9f0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:06 GMT
content-encoding: gzip
content-type: text/javascript
status: 200
cache-control: no-cache, no-store, must-revalidate
content-length: 858
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 86ms
86ms XHR
application/json 70.42.32.31
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585236666900&sessionId=323447cb-ccf1-18b3-ba73-f36d6aad8e5d&url=www.theregister.co.uk&cheqSource=1&cheqEvent=2&responseTime=1731
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585236664261
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Mar 2020 15:31:06 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 65bc23d5a1d160049a5141dba9a3e702
Content-Length: 4
Expires: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020032301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3af28f1f505a034620e75fb4e3ad351f83016f40f74a449eadd254a010628513

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin: https://www.theregister.co.uk
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Mar 2020 15:31:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5134
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js?21065763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 26 Mar 2020 15:31:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Thu, 26 Mar 2020 15:31:07 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 9C3A 0
0 6ms
6ms Document
text/html 2a00:1450:4001:81b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Thu, 26 Mar 2020 14:40:15 GMT
expires: Fri, 26 Mar 2021 14:40:15 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3053
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 15ms
15ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020032301&jk=3387627700450064&bg=!u7iluKBYBDGOiontgS0CAAAAXFIAAAAOmQFhhCWi2EZzZ2a0E_WrVtE5k1VgGJTQ5Zj_u_Cc7Q7IgcDXrxzz4A2pGNjYvjH6fjhxOQv2rAMaVJjF7RSIs5DPTL5e1ZbdmNLk5hiTd9cqV3nArhx4Id-ZZc9Y6xSn3fNB6CFFNcV1JlSLn5VW0IFNJSUO4aUb8ySu2kZaff1HpGKXWk4DjMibJjVdM1JnyNkVmdTCn1CbamvlxlGVaWAAWfxZdJw_-frEmY-f4JFxDnc_NE2NeJXVBw_HGT8V19SHqobS8OI-BsuXGozPoDyoMRXVlkVSUwdv7zjxxV2dQmjjJ0_g4Y4ijWrPhSNRxf7vzGigSLZHnwUL7caOgzBD6KNzJx51bXAa9u6WmpomYs4UH9HsNNk7yIzfkoLVx6xOoFtslZFS9wu0R981mHD_G13CjKf9LhUITl8YMcEGZub_8q9TEbAaD_SR36nhmCbDiFD36P7vybu1duOXaQ8ebB0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 26 Mar 2020 15:31:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads.js Show response
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ 27 B
261 B 34ms
34ms XHR
application/javascript 104.18.235.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by: Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 26 Mar 2020 15:31:09 GMT
cf-cache-status: HIT
age: 14718669
cf-ray: 57a1eabfaf13f3eb-LHR
status: 200
content-length: 27
x-clacks-overhead: GNU Terry Pratchett, Lester Haines
last-modified: Thu, 05 Apr 2018 12:48:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=33696000
accept-ranges: bytes
x-reg-bofh: pfy04
expires: Tue, 20 Apr 2021 15:31:09 GMT

Verdicts & Comments Add Verdict or Comment

170 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.outbrain.com/	1970-01-19 09:03:48	Name: rtbhs Value: JAUfuZijsa2euGfSUS6U
.outbrain.com/	1970-01-19 09:03:48	Name: actvagnt Value: 6808539636897020056
.outbrain.com/	1970-01-19 09:03:48	Name: mdfrc Value: 58e7bf58-fb1c-4620-b404-91b1e7bbce7d
widgets.outbrain.com/	1970-01-19 08:24:55	Name: OB-SYNC Value: 1585495865916
.theregister.co.uk/	1970-01-19 17:06:12	Name: bucket Value: 441
.outbrain.com/	1970-01-19 10:30:12	Name: obuid Value: 925a627d-9d57-4645-be52-a5c808ff9a97
.theregister.co.uk/	1970-01-19 09:03:48	Name: __cfduid Value: d9eeeb9f88c10faadde3c5a33301018f01585236664
.theregister.co.uk/	1970-01-19 10:30:12	Name: OB-USER-TOKEN Value: 925a627d-9d57-4645-be52-a5c808ff9a97
.outbrain.com/	1970-01-19 09:03:48	Name: ttd Value: d04ba18b-f597-4518-92c1-a81b740cab30
.theregister.co.uk/	1970-01-20 01:51:48	Name: __gads Value: ID=6342ab1aac3c8a17:T=1585236664:S=ALNI_MY513VG-qF1OAOhLVY5zXQkNqHECA
.theregister.co.uk/	1969-12-31 23:59:59	Name: sc Value: 1
.theregister.co.uk/	1970-01-19 08:20:36	Name: _gat Value: 1
.outbrain.com/	1970-01-19 09:03:48	Name: bdswch Value: c3bbb2d9-e730-4800-86ca-2dbc62955306
.theregister.co.uk/	1970-01-20 01:51:48	Name: _ga Value: GA1.3.464137936.1585236665
.theregister.co.uk/	1970-01-19 08:22:03	Name: _gid Value: GA1.3.1235985434.1585236665

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api	info	URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api	info	URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api	info	URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407) Message: Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.co.uk
adservice.google.com
cdn.ampproject.org
go.theregister.co.uk
log.outbrainimg.com
nir.theregister.co.uk
ob.cheqzone.com
obs.cheqzone.com
odb.outbrain.com
pagead2.googlesyndication.com
pj.l.admedo.com
regmedia.co.uk
securepubads.g.doubleclick.net
stats.g.doubleclick.net
tcheck.outbrainimg.com
tpc.googlesyndication.com
widgets.outbrain.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.theregister.co.uk
104.18.235.86
13.224.194.122
151.101.14.2
172.217.22.2
2606:4700::6810:5351
2a00:1450:4001:800::2002
2a00:1450:4001:800::200e
2a00:1450:4001:806::2004
2a00:1450:4001:809::2002
2a00:1450:4001:815::2002
2a00:1450:4001:81b::2001
2a00:1450:4001:81e::2003
2a00:1450:400c:c00::9b
2a02:6ea0:c710::2
34.232.73.12
70.42.32.31
95.101.185.159
95.101.186.38
01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
11b10fdb2a5de2bc29f16503b2ee10492c9441b12e7d1d0248ff764f62a0206d
120ce55883f26d68e2108231d7f0c6e772e186d2b9e6a4cf72cc6c75bc973e54
1bc9eeec7ba19c97ba1d50c10195c3f74302af5e712409e51e5b8d35b6f46eb8
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211
1ffdf58d2fdec024c3897183feb54fabdcccf8fd75c4bb8fff3b9ab1e0f1f9f0
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15
363edeba1963685d08a885c613f43fd3c94fa0ba6cea87de6036f960c9d38717
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
3a94325ee2b6a330841751fdccb8382830d03faf2bebb53601a023d54d181ee7
3af28f1f505a034620e75fb4e3ad351f83016f40f74a449eadd254a010628513
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
449bb084a71158da5d9ae64d5cf3c250f5614a0ada0cc4acb47c23dd4e896763
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
45e29fe553dec49ecfc954397433161ad73fd261b065cde97d8ae8171bd9c765
4c992dd3825c780cdbb4e11ea975fe529efb2dba73309e7d76ab55e938e0f323
4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892
508eaa55e9df71fb9daf249826540f803223f1931214ae738fae39ff11b60fe6
5d7c425ec702acde775f613749c0ffdea537ca0954df1a07b8f2a9fb36fffabc
5deb2c6e3a3a0be160b1b098aee1ccc3f4a210788b58e6a7886e0a53d2c3b49c
60a778c309adcbb2ab55da2dca559f33b2a4d42e63ff63938d64d235fdd695db
615d3776c617108f0603964f782f5f0ef6ee0037a2be5a575066c337302b7e8c
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace
656bd284abc1cd57ef7f0560f38010715977ce8976d079c14bc896efdd3e58c6
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33
6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a
6dbe8d0a195c111c9e6ce4c4c358324a86eb09eb018a41de488aa472eabefd21
765d97dbbba2fe7a092ed1d30b13d8ae57f44be6756eeea2b30b75447f7cd324
79476979f0dd352eede0c7a570e4c48648367be7d5b97fb5e1363e19f2462885
7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc
859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
8e1c1a43a151d1d5efd2c2c6c39a8c18f661c6681accf2ca7d014eb408364089
8e828d9afc61e11f2e9c94df1fe9f29697bc35c6b6c96380d0cdddefc1ac1a71
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824
95f0b8a588ddfbf5b37b38fcb1e50f745648419e25cc7ee2e503efc3ba93c990
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d
9d501e93d6f8d633677b0d71b23bd3bc4b7eb31ee5e7c49320218a6b5498cd27
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a985ced3bed93035de701eb779fbb2da0046ebd48579ec9e908ee46737767d67
ae80c6be45b57cd2ca90ac80afb05116263bce25f85d36628aa7fa6aefc9de69
b081c8d9b69d7b76779e033f58d9c0f79a254ecce6e2f18db0676090edad3b18
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
bc5ac78496578aad5b0b5fb5289c454cff6223c437bb250f9d97296189265d3d
c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7
cee965d8588a3964621f712da4c7baed4ef497edba69b63a902a69032efb5101
d0291ac5ec4df132e81a707bbfd0c1d0e5e64c543a7a14091c7a91000a407bdb
d4fe1c2ae3fedac39469ab8a9d0dcd10901e7412f65945f273b5df9208cfdef6
d8db699e718814dce4d71b8c7d981df5aed9df3d3b49eb5d8970c3f75c2547ad
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08
da1d90e854ff635bba337e2406bb42bbaffc6992601e8c281a536aa6fb91c5df
e099a9372c5c120a9e0ba1136dd283513937bedf9cca34b88300132cf585341c
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a
ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9
ea9766ee93dea33e983794ed004d0b336dbcdd33383da07e011faaa1f1875b42
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ee2fd813fd9cfaff970009ec85bd66e78b38691433b25111dfd7e73f9b0bc4bb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c
f49e029dc83f0fb71c9c27b0ffc6bacf534bfe19493c0372464e3c350c8c81d7
f677040712955dc4fc8e9f792849a092501ffec68788837915d8ff8ff7b0d1e2
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27

www.theregister.co.uk Open in urlscan Pro 104.18.235.86 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

102 Requests

100 %HTTPS

56 %IPv6

14 Domains

22 Subdomains

17 IPs

4 Countries

1639 kBTransfer

3817 kBSize

15 Cookies

33 Outgoing links

Redirected requests

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.theregister.co.uk Open in urlscan Pro
104.18.235.86 Public Scan

Screenshot
Live screenshot

Full Image

102
Requests

100 %
HTTPS

56 %
IPv6

14
Domains

22
Subdomains

17
IPs

4
Countries

1639 kB
Transfer

3817 kB
Size

15
Cookies

102 HTTP transactions
5 data transactions