www.zdnet.com Open in urlscan Pro
2a04:4e42:3::666  Public Scan

22 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/	506 KB 145 KB	889ms 875ms	Document text/html	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 63e9f5e7f913bee002876d5114ee725ea624e60666124e30d0f8dac7dc01aca2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.zdnet.com :scheme https :path /article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" last-modified Sat, 24 Jul 2021 11:56:32 GMT referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id d1ce27c2-1a0d-4ade-9a3b-758954ce0c0d x-xss-protection 1; mode=block date Sat, 24 Jul 2021 11:56:32 GMT via 1.1 varnish cache-control max-age=5400, private expires Sat, 24 Jul 2021 13:26:32 GMT set-cookie fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure; strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent content-length 147696
GET H2	200	main-ffbdca2020-rev.css www.zdnet.com/a/fly/css/core/	332 KB 56 KB	9ms 8ms	Stylesheet text/css	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash be2763b392fef6da89c066e70bceb08a0bf52d3d82291be9e8efc60396a154c5 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/css/core/main-ffbdca2020-rev.css pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 56719 x-xss-protection 1; mode=block last-modified Fri, 23 Jul 2021 13:32:04 GMT server ContentServer x-frame-options SAMEORIGIN etag "8cb09e42ef5c54ae69f9d7553c1b50fd" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 30 Jul 2021 13:32:57 GMT
GET H2	200	controls-2b4236ad17-rev.css www.zdnet.com/a/fly/css/video/htmlPlayerControls/	25 KB 4 KB	7ms 6ms	Stylesheet text/css	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-2b4236ad17-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 8d17b2550d7df3b04980e18b6c076357a3c315876c584fb7bcd3c3b235074504 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/css/video/htmlPlayerControls/controls-2b4236ad17-rev.css pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 4313 x-xss-protection 1; mode=block last-modified Fri, 23 Jul 2021 13:32:05 GMT server ContentServer x-frame-options SAMEORIGIN etag "bb1aeac9cb2de7bb1011a22b47dac5bc" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 30 Jul 2021 13:32:57 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	19 KB 7 KB	27ms 12ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1cb4f8ad1c77d76c76fec82ee2bb6ec3709d9d724e09f447327d62cc590aa067 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 ElyA2tEJE7gBmVkJbkUH5A== age 4039 vary Accept-Encoding content-length 6319 x-ms-lease-status unlocked last-modified Fri, 23 Jul 2021 01:58:42 GMT server cloudflare etag 0x8D94D7D65E6FA72 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 1ff76ed5-101e-0024-1f7e-7f41a8000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 673cf7403f664d89-FRA
GET H2	200	optanon-v1.1.0.js Show response www.zdnet.com/a/privacy/optanon/	36 KB 10 KB	6ms 6ms	Script application/javascript	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/privacy/optanon/optanon-v1.1.0.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 10444 x-xss-protection 1; mode=block last-modified Thu, 04 Mar 2021 19:22:21 GMT server ContentServer x-frame-options SAMEORIGIN etag "46e2aa30cbebb708b5fc468d57d56d8b" strict-transport-security max-age=31536000 content-language en via 1.1 varnish cache-control public, max-age=86400 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type application/javascript expires Fri, 16 Jul 2021 08:56:04 GMT
GET H2	200	dp-zdnet-headshot-feb-20201.jpg www.zdnet.com/a/hub/i/r/2020/02/06/6f24b751-729c-4ed9-9fae-979667f1d3b3/thumbnail/40x40/85b0ebe5a0348cdc66d105b991ab3a53/	822 B 965 B	8ms 7ms	Image image/jpeg	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2020/02/06/6f24b751-729c-4ed9-9fae-979667f1d3b3/thumbnail/40x40/85b0ebe5a0348cdc66d105b991ab3a53/dp-zdnet-headshot-feb-20201.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash e4b830539c7c1da552be847860876d573320cc555d62bd7b4b638d7809543b56 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2020/02/06/6f24b751-729c-4ed9-9fae-979667f1d3b3/thumbnail/40x40/85b0ebe5a0348cdc66d105b991ab3a53/dp-zdnet-headshot-feb-20201.jpg pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1598037701101780 vary Accept-Encoding, Accept content-length 776 x-xss-protection 1; mode=block last-modified Fri, 09 Jul 2021 19:53:59 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"63a8dcb8bf0191a749d96db8e724814f" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sat, 18 Sep 2021 10:11:24 GMT
GET H2	200	5b3b428460b200b219dec555-1280x7201jul032018104933poster.jpg www.zdnet.com/a/hub/i/r/2018/07/03/a67d17c4-180c-400d-96c3-9553656fb269/thumbnail/570x322/fb3bb0e290ceaa12b75d14394d4f4106/	14 KB 15 KB	277ms 276ms	Image image/jpeg	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2018/07/03/a67d17c4-180c-400d-96c3-9553656fb269/thumbnail/570x322/fb3bb0e290ceaa12b75d14394d4f4106/5b3b428460b200b219dec555-1280x7201jul032018104933poster.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash af2dc09d58e1c26ff325d6e74aadb7df0eec7a76175f699856a985b59e8bcb6d Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2018/07/03/a67d17c4-180c-400d-96c3-9553656fb269/thumbnail/570x322/fb3bb0e290ceaa12b75d14394d4f4106/5b3b428460b200b219dec555-1280x7201jul032018104933poster.jpg pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1599089863341812 vary Accept-Encoding, Accept content-length 14731 x-xss-protection 1; mode=block last-modified Fri, 09 Jul 2021 19:50:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"488399be6a3ddfe6e2a8156b50c2b84e" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 22 Sep 2021 11:56:32 GMT
GET H2	200	medusa-adv.js Show response www.zdnet.com/a/fly/bundles/zdnetjs/js/utils/	537 B 467 B	6ms 6ms	Script application/javascript	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetjs/js/utils/medusa-adv.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 193912cd0d3b49f497bde819b8ffec467e546934e73fe980544fa3f2a59a1a01 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/bundles/zdnetjs/js/utils/medusa-adv.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 335 x-xss-protection 1; mode=block last-modified Thu, 15 Jul 2021 16:02:19 GMT server ContentServer x-frame-options SAMEORIGIN etag "5fc83998923febd38cb1be29c7ec8294" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sun, 25 Jul 2021 01:33:56 GMT
GET H2	200	malware-upload-jpg.jpg www.zdnet.com/a/hub/i/r/2015/08/03/e4620246-6146-4c72-b707-a08c919e7c1e/resize/220x165/c60914c57805d5870c370d626dfdd286/	19 KB 16 KB	8ms 7ms	Image image/jpeg	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2015/08/03/e4620246-6146-4c72-b707-a08c919e7c1e/resize/220x165/c60914c57805d5870c370d626dfdd286/malware-upload-jpg.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 3f673411e4617d53fd324e15c060927e71ec9e5db5013535efe6b1c9236c13fa Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2015/08/03/e4620246-6146-4c72-b707-a08c919e7c1e/resize/220x165/c60914c57805d5870c370d626dfdd286/malware-upload-jpg.jpg pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 16514 x-xss-protection 1; mode=block last-modified Wed, 02 Sep 2020 23:45:21 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"b5703024c620708cc851317c85a15adc" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sun, 05 Sep 2021 02:46:10 GMT
GET H2	200	require-2.1.2.js Show response www.zdnet.com/a/fly/js/libs/	16 KB 6 KB	6ms 6ms	Script application/javascript	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/libs/require-2.1.2.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Wed, 21 Jul 2021 15:02:44 GMT server ContentServer x-frame-options SAMEORIGIN etag "d7309b63b9707c76502c5357d40ff07d" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 29 Jul 2021 05:36:09 GMT
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame A5A4	205 KB 50 KB	23ms 9ms	Script application/javascript	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 24 Jul 2021 11:56:32 GMT Content-Encoding br Last-Modified Sun, 04 Jul 2021 11:31:35 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 50393
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	917 B 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	4 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET H2	200	mag-white01.png www.zdnet.com/a/fly/1627046962-asset/bundles/zdnetcss/images/core/	1 KB 1 KB	7ms 6ms	Image image/png	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1627046962-asset/bundles/zdnetcss/images/core/mag-white01.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1627046962-asset/bundles/zdnetcss/images/core/mag-white01.png pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 1265 x-xss-protection 1; mode=block last-modified Thu, 22 Jul 2021 18:43:05 GMT server ContentServer x-frame-options SAMEORIGIN date Sat, 24 Jul 2021 11:56:32 GMT strict-transport-security max-age=31536000 content-type image/png cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 30 Jul 2021 12:49:37 GMT
GET H2	200	ring-animated.svg www.zdnet.com/a/fly/1627046962-asset/bundles/zdnetcss/images/video/	704 B 817 B	7ms 6ms	Image image/svg+xml	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1627046962-asset/bundles/zdnetcss/images/video/ring-animated.svg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-2b4236ad17-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1627046962-asset/bundles/zdnetcss/images/video/ring-animated.svg pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-2b4236ad17-rev.css :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-2b4236ad17-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 704 x-xss-protection 1; mode=block last-modified Thu, 22 Jul 2021 18:43:05 GMT server ContentServer x-frame-options SAMEORIGIN etag "5f87ac7f571b5a0b1cdc101b49cdc8de" strict-transport-security max-age=31536000 content-type image/svg+xml cache-control max-age=604800 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 30 Jul 2021 13:17:25 GMT
GET H2	200	Semibold.woff2 www.zdnet.com/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 6ms	Font application/octet-stream	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers sec-fetch-mode cors origin https://www.zdnet.com accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu :path /bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Origin https://www.zdnet.com Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT via 1.1 varnish last-modified Wed, 14 Jul 2021 15:38:10 GMT etag "60ef04e2-4f78" vary Accept-Encoding, User-Agent content-type application/octet-stream access-control-allow-origin * cache-control max-age=31536000 strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes timing-allow-origin * content-length 20344 expires Thu, 14 Jul 2022 23:43:11 GMT
GET H2	200	Regular.woff2 www.zdnet.com/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	8ms 7ms	Font application/octet-stream	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers sec-fetch-mode cors origin https://www.zdnet.com accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu :path /bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Origin https://www.zdnet.com Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT via 1.1 varnish last-modified Wed, 14 Jul 2021 15:38:10 GMT etag "60ef04e2-4f20" vary Accept-Encoding, User-Agent content-type application/octet-stream access-control-allow-origin * cache-control max-age=31536000 strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes timing-allow-origin * content-length 20256 expires Thu, 14 Jul 2022 23:52:50 GMT
GET H2	200	logo.png www.zdnet.com/a/fly/1627046962-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	6ms 6ms	Image image/png	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1627046962-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1627046962-asset/bundles/zdnetcss/images/core/logo.png pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/a/fly/css/core/main-ffbdca2020-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 4105 x-xss-protection 1; mode=block last-modified Fri, 23 Jul 2021 13:32:07 GMT server ContentServer x-frame-options SAMEORIGIN date Sat, 24 Jul 2021 11:56:32 GMT strict-transport-security max-age=31536000 content-type image/png cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 30 Jul 2021 13:33:11 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	31ms 17ms	XHR application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 xkIaWO5Hr0+rNu9IdoYHdw== age 3847 vary Accept-Encoding content-length 1425 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:53 GMT server cloudflare etag 0x8D94223473B0939 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 1a5be266-c01e-00ea-2d0c-7427e7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 673cf7410e624303-FRA
GET H2	200	main.default.js Show response www.zdnet.com/a/fly/819525-fly/js/	828 KB 248 KB	6ms 6ms	Script application/javascript	2a04:4e42:3::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/819525-fly/js/main.default.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 80884a4820bc16abbcc5b2cc698603b96da5d274b1e928389671dc1a075dda3c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/819525-fly/js/main.default.js pragma no-cache cookie fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 253411 x-xss-protection 1; mode=block last-modified Fri, 23 Jul 2021 13:31:56 GMT server ContentServer x-frame-options SAMEORIGIN etag "bd7bab824aa88fac271935cd39afcd43" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 30 Jul 2021 13:33:00 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame A5A4	2 KB 1 KB	51ms 39ms	XHR application/json	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5423759&v=1.720.0&if=&sl=0&si=9422ac40-1778-4db3-a509-a1021c699b05-qwqzu8&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 796ed03f73e7953d2e0cd18be4c3f9ca7b19144919248a80aaa7157f4b4ed45a Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 24 Jul 2021 11:56:32 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 793
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	164 B 373 B	37ms 22ms	Script text/javascript	2606:4700:10::6814:b844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 673cf7414de84ac3-FRA
OPTIONS H2	200	diff at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame	0 0	197ms 140ms	Preflight text/html	151.101.130.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Protocol H2 Server 151.101.130.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context c96f2b6d55aa2ce96a2facd8bf48ff89 server Google Frontend accept-ranges bytes date Sat, 24 Jul 2021 11:56:33 GMT via 1.1 varnish x-served-by cache-ams21020-AMS x-cache MISS x-cache-hits 0 x-timer S1627127793.979085,VS0,VE118 vary Accept-Encoding, Origin content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/	95 KB 25 KB	92ms 29ms	Script text/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/819525-fly/js/main.default.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 78e1575cb467607b24f53fb2a0d3c104576eea25871baccc550b3cde530a6926 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 24 Jul 2021 11:56:32 GMT Content-Encoding gzip Age 1516 X-Cache HIT Connection keep-alive Content-Length 24909 x-amz-id-2 mFCSz62tPhpCXVAA9Ngn129Jrmr0T/KoAq/plJlGoQKAZywmsXm8xPPk1KPEnYmn74RJwvmUvbA= X-Served-By cache-fra19167-FRA Last-Modified Sat, 24 Jul 2021 08:45:25 GMT Server AmazonS3 X-Timer S1627127793.963837,VS0,VE0 ETag "3590d93c9c4cb129fdc9d70f998b2e9f" x-amz-request-id T2ZMD7WEE8HGX3XM Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 23
GET H2	200	diff Show response at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/	180 B 358 B	23ms 23ms	Fetch application/json	151.101.130.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/819525-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash 0836880c45977e6d76d96cdfa0ccdd4607d0d00a57400189ced3e78b46bb5896 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json cat qMonyWr2w Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ version rv2.23.2 variant core User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff age 66 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 175 x-xss-protection 1; mode=block x-served-by cache-ams21020-AMS access-control-allow-origin * server Google Frontend x-timer S1627127793.120200,VS0,VE0 x-frame-options SAMEORIGIN date Sat, 24 Jul 2021 11:56:33 GMT x-download-options noopen vary Accept-Encoding, Origin content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context 4b3fe914b8efbcd4b6d9c5e293f92368 cache-control max-age=900 etag W/31eb5f8de72e86131dace36cb5163414bf40fda0 accept-ranges bytes access-control-allow-headers * x-cache-hits 1
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	68 KB 24 KB	103ms 38ms	Script text/javascript	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/819525-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software sffe / Resource Hash e27a7a4fb59bde150e8d0a7a82ddf81af5f60b741098e0a6dfa2d4bfefaa1b2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:33 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "938 / 944 of 1000 / last-modified: 1627080183" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24038 x-xss-protection 0 expires Sat, 24 Jul 2021 11:56:33 GMT
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.20.0/	376 KB 84 KB	15ms 15ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jOOTzA5W9ewbfwCUPpt/mw== age 2337935 vary Accept-Encoding content-length 86053 x-ms-lease-status unlocked last-modified Thu, 24 Jun 2021 12:22:20 GMT server cloudflare etag 0x8D9370AB6896F5E expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 1e85a95a-b01e-0126-433f-6b0507000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=691200 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 673cf741ea824d89-FRA expires Sun, 01 Aug 2021 11:56:32 GMT
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/	93 KB 20 KB	16ms 15ms	Fetch application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 11:56:32 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 AlmWtxV11YCExQkuyz0PJA== age 3846 vary Accept-Encoding content-length 20136 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:59 GMT server cloudflare etag 0x8D942234AE979B3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 47dfc248-601e-0142-330c-74b5a7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 673cf74228ea4303-FRA
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.20.0/assets/	13 KB 3 KB	13ms 12ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 11:56:33 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OL7qnwFOarng5AW29V9Pw== age 1370391 vary Accept-Encoding content-length 2950 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:42 GMT server cloudflare etag 0x8D94112485FC2D3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id ef5fe39e-501e-0168-4b0c-74c0e2000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=691200 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 673cf742593c4303-FRA expires Sun, 01 Aug 2021 11:56:33 GMT
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202107221237/	173 KB 55 KB	30ms 29ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202107221237/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash fb5a98aabe50a262aff3dec226a5913bb8f4bfddd6b4b66ba3db695661e660b3 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 24 Jul 2021 11:56:33 GMT Content-Encoding gzip Age 833 X-Cache HIT Connection keep-alive Content-Length 55664 x-amz-id-2 YgWJMHbf8RgTm8fLCXHLfIucIlozsrVhzz05JrHpkKLN7nOQkLkrIFml8Q5ri97PmWE06E7O9J8= X-Served-By cache-fra19167-FRA Last-Modified Thu, 22 Jul 2021 20:21:47 GMT Server AmazonS3 X-Timer S1627127793.031312,VS0,VE0 ETag "0292e0bd00fa4a5c715cfc1d2e1a5ec4" x-amz-request-id BJRNWG1W86J2B41H Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 312
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202107221237/	90 KB 30 KB	80ms 29ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202107221237/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 7a94bd85105c84010d20ba3d216472b4fa8febe831b2ab28980911c791d32b6e Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 24 Jul 2021 11:56:33 GMT Content-Encoding gzip Age 865 X-Cache HIT Connection keep-alive Content-Length 29698 x-amz-id-2 2MGhJuZw8wIao+lyamtCjUMOp5M+Ak2QGTulUtZFFdQeI1f1XuKoE0t1U8Gm86uwMvowl5wG2uw= X-Served-By cache-fra19167-FRA Last-Modified Thu, 22 Jul 2021 20:21:49 GMT Server AmazonS3 X-Timer S1627127793.083102,VS0,VE0 ETag "003ba01e7b61fd136afbfcdea464b0aa" x-amz-request-id 3DTFQB7AZC32T8SW Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 454
GET H2	200	cohesion-latest.min.js Show response cdn.cohesionapps.com/cohesion/	69 KB 19 KB	189ms 38ms	Script application/javascript	143.204.98.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-21.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash ead8951835edd6d5fc2917639bf95729d7b868ffd03f81bbd755134cf010064c Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip etag W/"3cadda3925033747f0b7b84ae70794a3" last-modified Tue, 13 Jul 2021 12:03:02 GMT server AmazonS3 age 40080 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript via 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront) date Sat, 24 Jul 2021 02:01:40 GMT x-amz-cf-pop FRA50-C1 x-amz-cf-id 2Nx06jk2RRKBowGQiSXyGLEDoJp3mTeHbpAtnkqpOx3wxokvQroaLg==
GET H2	200	;ord=1627127793077 ad.doubleclick.net/ddm/ad/nxwlrtyckdl/sbzmr/hsxa/dn/rarfcjcn/	43 B 649 B	127ms 39ms	Image image/gif	142.250.186.70 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/ad/nxwlrtyckdl/sbzmr/hsxa/dn/rarfcjcn/;ord=1627127793077? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.70 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f6.1e100.net Software cafe / Resource Hash 9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sat, 24 Jul 2021 11:56:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	pubads_impl_2021071401.js Show response securepubads.g.doubleclick.net/gpt/	329 KB 115 KB	77ms 38ms	Script text/javascript	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software sffe / Resource Hash 65506c87a4e71875a107df7ca37f45ccfd40688cf8e01f65c7e71792dbd6818c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Jul 2021 11:56:33 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Jul 2021 08:38:54 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 117283 x-xss-protection 0 expires Sat, 24 Jul 2021 11:56:33 GMT
GET H3-29	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 153 B	75ms 38ms	XHR application/json	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software cafe / Resource Hash 12717f96c61a500136a8564d666db9b960869a71dd3176a438b53fb08be5c7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Sat, 24 Jul 2021 11:56:33 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128 x-xss-protection 0 expires Sat, 24 Jul 2021 11:56:33 GMT
POST H/1.1	204 No Content	/ 1737ad5c.akstat.io/	0 354 B	42ms 29ms	Ping image/gif	2a02:26f0:6c00:2b9::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://1737ad5c.akstat.io/ Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:2b9::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/shrug-ransomware-victim-heres-how-to-retrieve-your-locked-files-for-free/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sat, 24 Jul 2021 11:56:34 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Sat, 24 Jul 2021 11:56:34 GMT