URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Submission: On March 13 via api from US

Summary

This website contacted 15 IPs in 3 countries across 13 domains to perform 127 HTTP transactions. The main IP is 104.18.235.86, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.theregister.co.uk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 4th 2019. Valid for: a year.
This is the only time www.theregister.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

Domain Requested by
26 www.theregister.co.uk www.theregister.co.uk
25 cdn.ampproject.org securepubads.g.doubleclick.net
24 tpc.googlesyndication.com www.theregister.co.uk
securepubads.g.doubleclick.net
tpc.googlesyndication.com
cdn.ampproject.org
17 regmedia.co.uk www.theregister.co.uk
9 securepubads.g.doubleclick.net www.theregister.co.uk
securepubads.g.doubleclick.net
4 pagead2.googlesyndication.com securepubads.g.doubleclick.net
4 nir.theregister.co.uk www.theregister.co.uk
3 www.google.com 3 redirects
2 googleads.g.doubleclick.net
2 fonts.gstatic.com www.theregister.co.uk
2 www.google-analytics.com www.theregister.co.uk
1 go.theregister.co.uk 1 redirects
1 fonts.googleapis.com securepubads.g.doubleclick.net
1 www.googletagservices.com securepubads.g.doubleclick.net
1 e3df9258692d254ffd61805e6baffdd1.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 632d3519b683c119b8dfe7c0ad2f6d84.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 5f0ab371126819f126035e749d6e70b0.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 c9f61e66ac8b18e5752d6f521711aaef.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 11043ed952c1f188ee59af40171ba6b6.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 6005eeeb17bb901c1a936f348cffa880.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 www.google.de www.theregister.co.uk
1 stats.g.doubleclick.net 1 redirects
1 pj.l.admedo.com www.theregister.co.uk
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.co.uk securepubads.g.doubleclick.net
127 25
Subject Issuer Validity Valid
theregister.co.uk
CloudFlare Inc ECC CA-2
2019-10-04 -
2020-10-03
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh
ssl909866.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-10-31 -
2020-05-08
6 months crt.sh
*.google.com
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh
pj.l.admedo.com
Amazon
2019-07-05 -
2020-08-05
a year crt.sh
www.google.de
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh
misc-sni.google.com
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh
*.storage.googleapis.com
GTS CA 1O1
2020-02-25 -
2020-05-19
3 months crt.sh

This page contains 7 frames:

Primary Page: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Frame ID: A650D48C1F246D46C8AF31214595B044
Requests: 68 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Frame ID: 67BEA876BDF4022870D4E0D71D577408
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Frame ID: 7E14D126F24E4CDFCD966D96ADE704D6
Requests: 18 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Frame ID: 21862247CCEF549F2014E37CA015D36F
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Frame ID: 070FCFD1F27A07EEFFBF6E3F137B1E35
Requests: 15 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Frame ID: D19EAF26A5167F7F9BF52CB955719E9A
Requests: 15 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 9E632DF3EBBC24533FC62543011CC0E0
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

127
Requests

100 %
HTTPS

81 %
IPv6

13
Domains

25
Subdomains

15
IPs

3
Countries

1588 kB
Transfer

4181 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&gjid=2116587537&_gid=1237704130.1584113081&_u=YGBAiAABB~&z=241888929 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&_v=j81&z=241888929 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&_v=j81&z=241888929&slf_rd=1&random=3041334683
Request Chain 114
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 115
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 127
  • https://go.theregister.co.uk/k/abt_a HTTP 302
  • https://regmedia.co.uk/2007/09/13/tp.gif

127 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
62 KB
14 KB
Document
General
Full URL
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd8237eb5b0960c24d820d8ac24f6882c8edcd9567587ce8eff968c707321a11

Request headers

:method
GET
:authority
www.theregister.co.uk
:scheme
https
:path
/2020/03/12/ransomware_illinois_health/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
date
Fri, 13 Mar 2020 15:24:40 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d61f1e389cb3e5512e8b0d3124e60fabc1584113080; expires=Sun, 12-Apr-20 15:24:40 GMT; path=/; domain=.theregister.co.uk; HttpOnly; SameSite=Lax
cache-control
max-age=0
expires
Fri, 13 Mar 2020 15:24:40 GMT
vary
Accept-Encoding
x-reg-bofh
pfy01gb
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5736c361cc15ce2b-LHR
content-encoding
br
scaffolding.css
www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/
19 KB
4 KB
Stylesheet
General
Full URL
https://www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/scaffolding.css
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
07d1b5f6b5b02c8d91f22f6c0e837c7649a7a144035c30dafab3ebbd663059b1

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Tue, 03 Mar 2020 14:58:18 GMT
server
cloudflare
age
693850
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
x-reg-bofh
pfy01gb
cache-control
public, max-age=33696000
cf-ray
5736c3625db4ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
design.css
www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/
52 KB
11 KB
Stylesheet
General
Full URL
https://www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/design.css
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 05 Mar 2020 14:40:15 GMT
server
cloudflare
age
693850
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
5736c3625db9ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
_.js
www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/
208 KB
59 KB
Script
General
Full URL
https://www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/_.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c9a6e7c16ce382aa1be3468a5cfb2225649a40c8fec610d4f75d1ee54090789

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 12 Mar 2020 10:28:50 GMT
server
cloudflare
age
104134
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
x-reg-bofh
pfy01gb
cache-control
public, max-age=33696000
cf-ray
5736c3625dbace2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/
43 KB
14 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
3daac55ae8e37e4d6eabd36903eaa318ead4759b398faff5ac5814cda3d13b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"454 / 536 of 1000 / last-modified: 1584030004"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14485
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:40 GMT
reg_logo.svg
www.theregister.co.uk/design_picker/fa16d26efb42e6ba1052f1d387470f643c5aa18d/graphics/std/
15 KB
5 KB
Image
General
Full URL
https://www.theregister.co.uk/design_picker/fa16d26efb42e6ba1052f1d387470f643c5aa18d/graphics/std/reg_logo.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
363edeba1963685d08a885c613f43fd3c94fa0ba6cea87de6036f960c9d38717

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 26 Sep 2019 14:47:16 GMT
server
cloudflare
age
11012126
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
5736c3625dbbce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
search.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/
609 B
424 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
10491447
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
5736c3629e25ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
vulture.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
2 KB
883 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
640420
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
5736c362beb7ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
search.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/
609 B
394 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/search.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
14038193
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
5736c362ff53ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
dl.gif
regmedia.co.uk/2016/04/14/
35 B
370 B
Image
General
Full URL
https://regmedia.co.uk/2016/04/14/dl.gif
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
880430
cf-polished
origSize=43, status=webp_bigger
cf-ray
5736c3632cf1d719-FRA
status
200
cf-bgj
imgq:85
content-length
35
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 14 Apr 2016 13:41:38 GMT
server
cloudflare
etag
"2b-530720dc4f2ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01
expires
Wed, 07 Apr 2021 15:24:40 GMT
rect_comment_bubble_white.svg
www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/
496 B
358 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/rect_comment_bubble_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
986139
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
5736c3631f8bce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
reddit.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
1 KB
648 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/reddit.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
14026168
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
5736c3631f8cce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
twitter.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
745 B
475 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/twitter.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
14038193
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
5736c3631f8ece2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
facebook.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
311 B
271 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/facebook.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
368578
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
5736c3631f8fce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
linkedin_alt.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
363 B
287 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_alt.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
9278459
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
5736c3631f90ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
shutterstock_illinois_ransomware.jpg
regmedia.co.uk/2020/03/12/
25 KB
25 KB
Image
General
Full URL
https://regmedia.co.uk/2020/03/12/shutterstock_illinois_ransomware.jpg?x=442&y=293&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e099a9372c5c120a9e0ba1136dd283513937bedf9cca34b88300132cf585341c

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
53044
cf-polished
qual=85, origFmt=jpeg, origSize=27689
cf-ray
5736c3632cf2d719-FRA
status
200
content-disposition
inline; filename="shutterstock_illinois_ransomware.webp"
cf-bgj
imgq:85
content-length
25370
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 12 Mar 2020 23:59:25 GMT
server
cloudflare
etag
"6c29-5a0b1248581ba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
ship_shutterstock.jpg
regmedia.co.uk/2017/08/16/
2 KB
2 KB
Image
General
Full URL
https://regmedia.co.uk/2017/08/16/ship_shutterstock.jpg?x=174&y=115&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b081c8d9b69d7b76779e033f58d9c0f79a254ecce6e2f18db0676090edad3b18

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
54764
cf-polished
qual=85, origFmt=jpeg, origSize=2417
cf-ray
5736c3632cf6d719-FRA
status
200
content-disposition
inline; filename="ship_shutterstock.webp"
cf-bgj
imgq:85
content-length
2344
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Mon, 03 Feb 2020 11:08:02 GMT
server
cloudflare
etag
"971-59da9efdb638b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
solitary.jpg
regmedia.co.uk/2020/03/12/
6 KB
7 KB
Image
General
Full URL
https://regmedia.co.uk/2020/03/12/solitary.jpg?x=200&y=200&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63deef7c108a190fd0bd1a2a45f1a9e74c6402a77b39632c45e664cc615b2672

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
29521
cf-polished
qual=85, origFmt=jpeg, origSize=6780
cf-ray
5736c3632cf4d719-FRA
status
200
content-disposition
inline; filename="solitary.webp"
cf-bgj
imgq:85
content-length
6328
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 13 Mar 2020 07:12:15 GMT
server
cloudflare
etag
"1a7c-5a0b7306875d3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
shuttterstock_baby_dad_wfh.jpg
regmedia.co.uk/2020/03/12/
8 KB
8 KB
Image
General
Full URL
https://regmedia.co.uk/2020/03/12/shuttterstock_baby_dad_wfh.jpg?x=200&y=200&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9ab3b31a7fdf53823cbeb2b3b47a6c0152fd93cb0891659614db33645cb34ce

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
22323
cf-polished
qual=85, origFmt=jpeg, origSize=8314
cf-ray
5736c3632cf7d719-FRA
status
200
content-disposition
inline; filename="shuttterstock_baby_dad_wfh.webp"
cf-bgj
imgq:85
content-length
8204
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 12 Mar 2020 07:31:32 GMT
server
cloudflare
etag
"207a-5a0a35792fc61"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
shutterstock_botnet.jpg
regmedia.co.uk/2020/03/11/
6 KB
6 KB
Image
General
Full URL
https://regmedia.co.uk/2020/03/11/shutterstock_botnet.jpg?x=200&y=200&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
890ed0141e72fffa470e0fdef4dbe9043b01e116ba763dd858a5100b05a9c072

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
43541
cf-polished
qual=85, origFmt=jpeg, origSize=7034
cf-ray
5736c3632cf9d719-FRA
status
200
content-disposition
inline; filename="shutterstock_botnet.webp"
cf-bgj
imgq:85
content-length
6158
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 13 Mar 2020 03:12:32 GMT
server
cloudflare
etag
"1b7a-5a0b3d7297989"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
shutterstock_xerox_hp.jpg
regmedia.co.uk/2020/02/25/
11 KB
11 KB
Image
General
Full URL
https://regmedia.co.uk/2020/02/25/shutterstock_xerox_hp.jpg?x=200&y=200&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7fe3424135288c8b6ef9fcd0843e1951de48403763be4a56dc4484574775bc5

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
22323
cf-polished
status=not_needed
cf-ray
5736c3633d2cd719-FRA
status
200
cf-bgj
imgq:85
content-length
11394
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 11 Mar 2020 17:31:26 GMT
server
cloudflare
etag
"2c82-5a0979b1baae6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
antimony_nucleus.jpg
regmedia.co.uk/2020/03/11/
3 KB
4 KB
Image
General
Full URL
https://regmedia.co.uk/2020/03/11/antimony_nucleus.jpg?x=200&y=200&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67ebf1b15c9432153a2cbab9257cd24fff3c661e39e65f3558536bbefae27ae0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
726
cf-polished
qual=85, origFmt=jpeg, origSize=4267
cf-ray
5736c3633d2ed719-FRA
status
200
content-disposition
inline; filename="antimony_nucleus.webp"
cf-bgj
imgq:85
content-length
3580
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 12 Mar 2020 11:35:19 GMT
server
cloudflare
etag
"10ab-5a0a6bf5e4612"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
vulture_16bits_half.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
7 KB
1 KB
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture_16bits_half.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1bc9eeec7ba19c97ba1d50c10195c3f74302af5e712409e51e5b8d35b6f46eb8

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Tue, 01 Oct 2019 14:16:02 GMT
server
cloudflare
age
14026168
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
5736c3631f92ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
ship_shutterstock.jpg
regmedia.co.uk/2017/08/16/
3 KB
3 KB
Image
General
Full URL
https://regmedia.co.uk/2017/08/16/ship_shutterstock.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52a099f3b2c31bf42c37aff7f27c13b00e2dd36acd05a2a413ab67c04d5ac362

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
745533
cf-polished
qual=85, origFmt=jpeg, origSize=2965
cf-ray
5736c3633d30d719-FRA
status
200
content-disposition
inline; filename="ship_shutterstock.webp"
cf-bgj
imgq:85
content-length
2828
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 16 Oct 2018 04:30:23 GMT
server
cloudflare
etag
"b95-578510322e3d6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
zombiehandgrave.jpg
regmedia.co.uk/2018/05/03/
5 KB
6 KB
Image
General
Full URL
https://regmedia.co.uk/2018/05/03/zombiehandgrave.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
449bb084a71158da5d9ae64d5cf3c250f5614a0ada0cc4acb47c23dd4e896763

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
726209
cf-polished
qual=85, origFmt=jpeg, origSize=9056
cf-ray
5736c3633d31d719-FRA
status
200
content-disposition
inline; filename="zombiehandgrave.webp"
cf-bgj
imgq:85
content-length
5516
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 03 May 2018 15:22:35 GMT
server
cloudflare
etag
"2360-56b4ec5eb08e1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
windows_xp_professional_loading_screen.jpg
regmedia.co.uk/2017/06/27/
2 KB
3 KB
Image
General
Full URL
https://regmedia.co.uk/2017/06/27/windows_xp_professional_loading_screen.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea9766ee93dea33e983794ed004d0b336dbcdd33383da07e011faaa1f1875b42

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
840973
cf-polished
qual=85, origFmt=jpeg, origSize=2445
cf-ray
5736c3633d32d719-FRA
status
200
content-disposition
inline; filename="windows_xp_professional_loading_screen.webp"
cf-bgj
imgq:85
content-length
2216
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sun, 14 Oct 2018 02:21:38 GMT
server
cloudflare
etag
"98d-57826faf78898"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
hacker_shutterstock.jpg
regmedia.co.uk/2018/07/16/
5 KB
5 KB
Image
General
Full URL
https://regmedia.co.uk/2018/07/16/hacker_shutterstock.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00a90076624308d96229a561974d2d72398e2d48e4a8e9dbdcf178904014aac6

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
749744
cf-polished
qual=85, origFmt=jpeg, origSize=5025
cf-ray
5736c3633d36d719-FRA
status
200
content-disposition
inline; filename="hacker_shutterstock.webp"
cf-bgj
imgq:85
content-length
4962
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 06 Nov 2019 19:20:27 GMT
server
cloudflare
etag
"13a1-596b2710084e6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
shutterstock_sad_dog_w648.jpg
regmedia.co.uk/2015/08/19/
3 KB
3 KB
Image
General
Full URL
https://regmedia.co.uk/2015/08/19/shutterstock_sad_dog_w648.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e64701668bca96d27f23530ca9631ef8b27a0e5ffe6bc39d8c54631f79bff14c

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
348997
cf-polished
degrade=85, origSize=9183, status=webp_bigger
cf-ray
5736c3633d38d719-FRA
status
200
cf-bgj
imgq:85
content-length
3333
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sat, 23 Sep 2017 10:19:57 GMT
server
cloudflare
etag
"23df-559d8aad70a69"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
shutterstock_sad_kids.jpg
regmedia.co.uk/2017/08/04/
8 KB
8 KB
Image
General
Full URL
https://regmedia.co.uk/2017/08/04/shutterstock_sad_kids.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb0837329b8e5d40a6f9da4ba0b3e7919112e2d709cef2b66557529f0983fc0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
76015
cf-polished
qual=85, origFmt=jpeg, origSize=9349
cf-ray
5736c3633d39d719-FRA
status
200
content-disposition
inline; filename="shutterstock_sad_kids.webp"
cf-bgj
imgq:85
content-length
7820
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sat, 29 Feb 2020 00:12:38 GMT
server
cloudflare
etag
"2485-59fabcfd55f8e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
windows_xp_boots.jpg
regmedia.co.uk/2019/03/12/
6 KB
6 KB
Image
General
Full URL
https://regmedia.co.uk/2019/03/12/windows_xp_boots.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98aeedb0588e7ae50a4907abb353ef409dcf215cd35153f610e14f784a08ea90

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
195509
cf-polished
qual=85, origFmt=jpeg, origSize=11340
cf-ray
5736c3633d3ad719-FRA
status
200
content-disposition
inline; filename="windows_xp_boots.webp"
cf-bgj
imgq:85
content-length
5646
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 13 Mar 2019 22:51:15 GMT
server
cloudflare
etag
"2c4c-58401a4a54937"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
shutterstock_microsoft_disguise.jpg
regmedia.co.uk/2020/03/03/
8 KB
8 KB
Image
General
Full URL
https://regmedia.co.uk/2020/03/03/shutterstock_microsoft_disguise.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6f77831a67ab9537e390ad6a3f6f0430a1f68911b2c4cbd28f91e8aa0916138

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
725620
cf-polished
status=not_needed
cf-ray
5736c3633d3dd719-FRA
status
200
cf-bgj
imgq:85
content-length
8517
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 04 Mar 2020 19:19:39 GMT
server
cloudflare
etag
"2145-5a00c4d4047b9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Wed, 07 Apr 2021 15:24:40 GMT
whitepaper_book.png
www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/
1 KB
1 KB
Image
General
Full URL
https://www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/whitepaper_book.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
9623199
cf-ray
5736c3631f94ce2b-LHR
status
200
content-length
1119
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 17 Feb 2017 15:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01
expires
Wed, 07 Apr 2021 15:24:40 GMT
footer_mob_nav_arrow_black.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
331 B
261 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_black.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
14038193
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
5736c3631f95ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
sitpub_footer.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
8 KB
3 KB
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/sitpub_footer.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
9865566
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
5736c3631f96ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
footer_mob_nav_arrow_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
328 B
284 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
33378731
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
5736c3632fc4ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
linkedin_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
371 B
303 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
1072314
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02gb
cache-control
public, max-age=33696000
cf-ray
5736c3632fc5ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
rss.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/
400 B
335 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/rss.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
21989426
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
5736c3632fc6ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
/
nir.theregister.co.uk/
144 B
647 B
Script
General
Full URL
https://nir.theregister.co.uk/?g=vk&g=c&g=sa&g=vvfc&s=c/sec.front&s=vk/malware&s=vk/coronavirus&s=vk/hacking&s=vk/ransomware&s=vvfc/6b2938ed106729c71e35884fc3f9730d&s=vvfc/6b2938ed106729c71e35884fc3f9730d&s=vvfc/6b2938ed106729c71e35884fc3f9730d
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
182d1155257f38f4cb3c981791932f618848901ae5ca032f3fe256dac200002b

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
5736c3632fc9ce2b-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy02gb
expires
Thu, 01 Jan 1970 00:00:00 GMT
integrator.js
adservice.google.co.uk/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.co.uk/adsid/integrator.js?domain=www.theregister.co.uk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.theregister.co.uk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2020030501.js
securepubads.g.doubleclick.net/gpt/
165 KB
60 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
61481
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:40 GMT
arimo-400.latin.woff2
www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/
26 KB
26 KB
Font
General
Full URL
https://www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-400.latin.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9

Request headers

Referer
https://www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/scaffolding.css
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
381175
status
200
content-length
26144
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 04 Feb 2020 15:35:20 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
https://www.theregister.co.uk
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
5736c3632fcbce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
arimo-700.latin.woff2
www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/
25 KB
25 KB
Font
General
Full URL
https://www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-700.latin.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a

Request headers

Referer
https://www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/scaffolding.css
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
3281698
status
200
content-length
25628
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 04 Feb 2020 15:35:20 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
https://www.theregister.co.uk
x-reg-bofh
pfy01gb
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
5736c3632fccce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
promo_unit_arrow.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/
248 B
322 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/promo_unit_arrow.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed

Request headers

Referer
https://www.theregister.co.uk/css_picker/webkit/b8d0aeb13f3428645b7f49ca166aa460e2877239/design.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 24 Aug 2017 14:00:39 GMT
server
cloudflare
age
32422856
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
5736c363581bce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
envelope.svg
www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/
454 B
358 B
Image
General
Full URL
https://www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/envelope.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
9278459
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
5736c3637899ce2b-LHR
expires
Wed, 07 Apr 2021 15:24:40 GMT
analytics.js
www.google-analytics.com/
44 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
3069
date
Fri, 13 Mar 2020 14:33:31 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
18174
expires
Fri, 13 Mar 2020 16:33:31 GMT
admtracker.lib.min.js
pj.l.admedo.com/
6 KB
3 KB
Script
General
Full URL
https://pj.l.admedo.com/admtracker.lib.min.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.194.67 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-194-67.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d8db699e718814dce4d71b8c7d981df5aed9df3d3b49eb5d8970c3f75c2547ad

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:09:52 GMT
content-encoding
gzip
last-modified
Tue, 04 Feb 2020 16:09:45 GMT
server
AmazonS3
age
890
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public,max-age=900
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
3ZzHACifIOzzqvf2x5DrbiNXGbmMLnOHeSpQDG_49knooaJGm7K2wQ==
via
1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
collect
www.google-analytics.com/
35 B
109 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&aip=1&a=1472323935&t=pageview&_s=1&dl=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F12%2Fransomware_illinois_health%2F&ul=en-us&de=UTF-8&dt=Fresh%20virus%20misery%20for%20Illinois%3A%20Public%20health%20agency%20taken%20down%20by...%20web%20ransomware.%20Great%20timing%2C%20scumbags%20%E2%80%A2%20The%20Register&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&exp=A_aVnslITyK8U4soe88Piw.0&_u=YGBAiAABB~&jid=552224628&gjid=2116587537&cid=834316154.1584113081&tid=UA-33330076-1&_gid=1237704130.1584113081&cd2=Shaun%20Nichols&cd3=&cd4=www%20story&cd5=news&cd8=none&cd9=&cd10=&z=993556773
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 05 Mar 2020 00:20:06 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
745474
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&gjid=2116587537&_gid=1237704130.1584113081&_u=YGBAiAABB~&z=241888929
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&_v=j81&z=241888929
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&_v=j81&z=241888929&slf_rd=1&random=3041334683
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&_v=j81&z=241888929&slf_rd=1&random=3041334683
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:41 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=834316154.1584113081&jid=552224628&_v=j81&z=241888929&slf_rd=1&random=3041334683
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads.js
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/
27 B
142 B
XHR
General
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Mar 2020 15:24:40 GMT
cf-cache-status
HIT
age
13595080
cf-ray
5736c3641a5fce2b-LHR
status
200
content-length
27
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 05 Apr 2018 12:48:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy04
expires
Wed, 07 Apr 2021 15:24:40 GMT
ads
securepubads.g.doubleclick.net/gampad/
163 KB
22 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2283115455564837&correlator=3923454460433075&output=ldjh&impl=fifs&adsid=NT&eid=21065699%2C21065640%2C21065685&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200313&iu_parts=6978%2Creg_security%2Cfront&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C970x91%7C970x90%7C970x250%7C970x251%7C728x90%7C728x91%7C468x60%7C468x61%2C970x250%7C970x90%7C728x90%7C468x60%2C300x1050%7C300x600%7C300x250%7C300x252%2C300x601%7C300x250%7C300x251%7C300x100%7C300x50%2C300x250%7C300x1%7C300x50&ists=32&prev_scp=pos%3Dtop%26raptor%3Dkite%26unitnum%3D1%7Cpos%3Dtop%26raptor%3Dcondor%26unitnum%3D2%7Cpos%3Dbtm%26raptor%3Dhawk%26unitnum%3D3%7Cpos%3Dtop%26raptor%3Deagle%26unitnum%3D4%7Cpos%3Dmid%26raptor%3Dfalcon%26unitnum%3D5%7Cpos%3Dbtm%26raptor%3Dowl%26unitnum%3D6&cust_params=test%3D0%26protocol%3Dhttps%253A%26li%3Dnull%26uid%3Dnull%26sc%3D1%26bwidth%3D15%26bheight%3D12%26orientation%3Dlandscape%26mm_segments%3Dwd14916%252Cwd15295%252Cwd15434%26pid%3D207467%26pt%3Da%26axc%3Dnull%26kw%3Dmalware%252Ccoronavirus%252Chacking%252Cransomware%26cat%3Dnews%26tag%3Dnull%26author%3DShaun%252520Nichols%26year%3D2020%26nsfw%3Dnull%26vid%3Dnull%26ar%3Dfalse%26ct%3Ds-async%26vc%3Dsec.front%26sa%3D%26vk%3Dcoronavirus%252Cmalware%252Cransomware%252Chacking&cookie_enabled=1&bc=31&abxe=1&lmt=1584113080&dt=1584113080975&dlt=1584113080692&idt=262&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C308%2C293%2C978%2C978%2C331&adys=-12245933%2C129%2C2744%2C234%2C2055%2C3986&adks=1331772189%2C284626583%2C1390360203%2C2610646818%2C8582313%2C3059020159&ucis=6005eeeb17bb901c1a936f348cffa880%7C11043ed952c1f188ee59af40171ba6b6%7Cc9f61e66ac8b18e5752d6f521711aaef%7C5f0ab371126819f126035e749d6e70b0%7C632d3519b683c119b8dfe7c0ad2f6d84%7Ce3df9258692d254ffd61805e6baffdd1&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F12%2Fransomware_illinois_health%2F&dssz=24&icsg=3752&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x4581%7C1000x4581%7C1000x279%7C315x2442%7C315x2442%7C924x1228&msz=1x1%7C1000x105%7C1000x278%7C300x1050%7C300x601%7C924x250&ga_vid=834316154.1584113081&ga_sid=1584113081&ga_hid=1472323935&fws=132%2C4%2C4%2C4%2C4%2C4&ohw=1000%2C1000%2C1000%2C1000%2C1000%2C1000
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
7af1368aae8746606ac38123c548eeaa7d330c50b1d9f27a167f06c88009c382
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Mar 2020 15:24:41 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
21624
x-xss-protection
0
google-lineitem-id
61995219,5323762554,-1,5323762554,-1,-1
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
35665517499,138306325417,-1,138305947691,-1,-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.theregister.co.uk
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2020030501.js
securepubads.g.doubleclick.net/gpt/
69 KB
25 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
sffe /
Resource Hash
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 05 Mar 2020 14:08:10 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
25689
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:41 GMT
container.html
6005eeeb17bb901c1a936f348cffa880.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://6005eeeb17bb901c1a936f348cffa880.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

container.html
11043ed952c1f188ee59af40171ba6b6.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://11043ed952c1f188ee59af40171ba6b6.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

container.html
c9f61e66ac8b18e5752d6f521711aaef.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://c9f61e66ac8b18e5752d6f521711aaef.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

container.html
5f0ab371126819f126035e749d6e70b0.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://5f0ab371126819f126035e749d6e70b0.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

container.html
632d3519b683c119b8dfe7c0ad2f6d84.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://632d3519b683c119b8dfe7c0ad2f6d84.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

container.html
e3df9258692d254ffd61805e6baffdd1.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://e3df9258692d254ffd61805e6baffdd1.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

osd.js
www.googletagservices.com/activeview/js/current/
73 KB
27 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1583960025657856"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
27560
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:41 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 67BE
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 67BE
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 67BE
92 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dffd83700dd74d4524da45259085e0a134e06e87b4fe5b7fdf77134269da81ae
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75907
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28280
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cc22e164f6b16c78"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:34 GMT
truncated
/ Frame 67BE
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42b5b6a0977d8fc7c75afb12e5a0bf066663b2ef4fe16a4310f965c0d3bcf136

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-host-v0.js
cdn.ampproject.org/rtv/012002251816300/
20 KB
7 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8cebbfa1487e3dc67737bb93e04d96fef483b4b69cd67707d0cb4817e09a4335
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
2006
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7148
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 14:51:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"14121842040f9b16"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 14:51:15 GMT
/
nir.theregister.co.uk/
0
135 B
Script
General
Full URL
https://nir.theregister.co.uk/?s=sa/oid.102962979
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:41 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
5736c367ac6dce2b-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy03gb
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
nir.theregister.co.uk/
0
160 B
Script
General
Full URL
https://nir.theregister.co.uk/?s=sa/oid.2676820440
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:41 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
5736c367ac6fce2b-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy01gb
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
8728516385599933421
tpc.googlesyndication.com/simgad/ Frame 67BE
15 KB
16 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/8728516385599933421
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c28973c56e429444d5090977230c2a2da792d865a4aacd6a6b30900cfb0cfe7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 12 Mar 2020 13:01:53 GMT
x-content-type-options
nosniff
age
94968
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15796
x-xss-protection
0
last-modified
Tue, 07 Jan 2020 11:33:12 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 13:01:53 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 67BE
0
308 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstbqufxMsNCl55UuDNnGp82Y5LrYYb71X6PyH-2e-LAk1LgwEY_QWOFn-rBx0Majqrkiw0qcbgpiN-rBCpYBJ_1WW0WcMYvc7nzU8UOMt9RBwRpbSVw-IqVuNEu-sXf6P5Ejo8rqA7rbSdAu7dYFz1RJt1EWVHaE9G6QT2QPV_4pOVC_c4IvSX_hrvHlEbTfPSp78dO5AGvHEAD7ygHFzJ2gp8wOgD2KYp-HE7ospMWE_Wa6Mf9T4E1YDXiIbhbBoCtWe3ra4cg5i1QHkvwanpf0A&sai=AMfl-YSZvSPsDOYa90VYqwMnVxlnc8farPrSzIoZZiLnqTqL6Pcv0c_u83nua43wUAUGkUQYRzPywqAg2Cx7iApqyYubVzm0Qyh0_h4gP63AOQ&sig=Cg0ArKJSzCUuBhZm9KdFEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:41 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:41 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 7E14
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 7E14
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 7E14
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5b040cd620ed6482975472e60c4e67309a9375395a53aa7cba72489b76d61545
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75901
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5729
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a6109f8e72088d21"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:40 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 7E14
92 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dffd83700dd74d4524da45259085e0a134e06e87b4fe5b7fdf77134269da81ae
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75907
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28280
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cc22e164f6b16c78"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:34 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 7E14
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ef0229dbf3b245afa2fbd209ce7dba56323bcafc380f4ba46b112519bc94641
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75901
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1402
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"72fcdcddc4f213c3"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:40 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 7E14
46 KB
15 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e57c9bc67a827ad246d31b9e24e71d6574e54c00e06e875a8aa83063fe50692d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75898
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14837
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f3c2d481e0884561"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:43 GMT
css
fonts.googleapis.com/ Frame 7E14
7 KB
827 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 13 Mar 2020 15:24:41 GMT
server
ESF
date
Fri, 13 Mar 2020 15:24:41 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 13 Mar 2020 15:24:41 GMT
10480562429805870230
tpc.googlesyndication.com/daca_images/simgad/ Frame 7E14
16 KB
16 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/10480562429805870230?w=600&h=314
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
71651da4a0daf06bf487005c930c6fdbce983c32fe49e23c84689ee54bc95ec2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 11 Mar 2020 12:12:23 GMT
x-content-type-options
nosniff
age
184338
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
16033
x-xss-protection
0
last-modified
Sat, 25 Nov 2017 00:08:05 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 18 Mar 2020 12:12:23 GMT
4226955186752285934
tpc.googlesyndication.com/daca_images/simgad/ Frame 7E14
27 KB
27 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/4226955186752285934
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce79e943415d0166d579f967dd7f559b019269e09d6edc41e6adb8a8ff669b31
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 04 Feb 2020 16:30:40 GMT
x-content-type-options
nosniff
age
3279241
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
27277
x-xss-protection
0
last-modified
Sat, 25 Nov 2017 00:03:48 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 03 Feb 2021 16:30:40 GMT
truncated
/ Frame 7E14
206 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76ebd2a7078570fa9f6a50855b4ade57c6b558cca7c95801b2b247406b274975

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 7E14
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2d6878e28cd2fb1b94e3bc629a2267fcbba0a1604a99bf079640ca85a13caa78

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 2186
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 2186
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 2186
92 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dffd83700dd74d4524da45259085e0a134e06e87b4fe5b7fdf77134269da81ae
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75907
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28280
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cc22e164f6b16c78"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:34 GMT
truncated
/ Frame 2186
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b746fd6fd6ff3d97dcc04fcc7906d3de2d9ba7a04d28ee2d391fb3a43d152ebf

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 070F
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame 070F
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 070F
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5b040cd620ed6482975472e60c4e67309a9375395a53aa7cba72489b76d61545
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75901
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5729
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a6109f8e72088d21"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:40 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 070F
92 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dffd83700dd74d4524da45259085e0a134e06e87b4fe5b7fdf77134269da81ae
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75907
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28280
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cc22e164f6b16c78"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:34 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 070F
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ef0229dbf3b245afa2fbd209ce7dba56323bcafc380f4ba46b112519bc94641
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75901
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1402
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"72fcdcddc4f213c3"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:40 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame 070F
46 KB
15 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e57c9bc67a827ad246d31b9e24e71d6574e54c00e06e875a8aa83063fe50692d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75898
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14837
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f3c2d481e0884561"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:43 GMT
truncated
/ Frame 070F
207 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6066bf2c450c62b02fc04e3348ec6d7835c6fe2b429424c000aa0242a1929d9

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame D19E
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012002251816300/ Frame D19E
200 KB
55 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
29091
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
55732
x-xss-protection
0
server
sffe
date
Fri, 13 Mar 2020 07:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"854d89fb2a05ebd2"
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Mar 2021 07:19:50 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame D19E
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5b040cd620ed6482975472e60c4e67309a9375395a53aa7cba72489b76d61545
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75901
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5729
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a6109f8e72088d21"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:40 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame D19E
92 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dffd83700dd74d4524da45259085e0a134e06e87b4fe5b7fdf77134269da81ae
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75907
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28280
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cc22e164f6b16c78"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:34 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame D19E
3 KB
1 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ef0229dbf3b245afa2fbd209ce7dba56323bcafc380f4ba46b112519bc94641
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75901
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1402
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"72fcdcddc4f213c3"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:40 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012002251816300/v0/ Frame D19E
46 KB
15 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012002251816300/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e57c9bc67a827ad246d31b9e24e71d6574e54c00e06e875a8aa83063fe50692d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
75898
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14837
x-xss-protection
0
server
sffe
date
Thu, 12 Mar 2020 18:19:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f3c2d481e0884561"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 18:19:43 GMT
truncated
/ Frame D19E
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c518bb3d731d8a3ef8c15323d9a1944d1ae6d6be8e92b8a65c9cae7d0241ebe8

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E14
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 11:08:58 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
15343
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Sat, 14 Mar 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E14
295 B
513 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 12:55:21 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
8960
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Sat, 14 Mar 2020 12:55:21 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 7E14
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CQ4wduaVrXv6ZBIWV3wOI5pzACM_X-fRTlqje0aUGtq6n2b4WEAEg1ofzE2C7vq6D0AqgAbmntP8DyAEJ4AIAqAMByAMKqgT_AU_QeY6a10Ah41qDK3eHVaVQw2IMlL7ibNtFlIKqsUsMXVuDBgEoUW4ThbEwNMrvFTE8aI_VLmHEmKsbuJnn9HUq4UG677KD4ucmKwHyOCm87zLTwxnS6-HVdbjlCJ6K1KWpE_M0ihDcNPYOn_Y5ihxg1tfc127GQt5BS7euPqzEcc7ObEZVZca0jfigYi67PkJ00uFoWF5s-WFfMD3Ag00jXObjunrzlJli8JIgTmO-w0r1iSuwSUlohddsEE3YxGYlANSoNaxJD5M7e5Na2PkwTUH43tHQQBXm_9cuFe2_bUGrz9SkAIxDhsIu8lyJ1iM4z-icuWmv42jJROe_GcAElJie8gfgBAGSBQQIBBgBkgUECAUYBKAGLoAHr9hLqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwDyBwQQiLYB0ggJCIDhgBAQARgdgAoDyAsB2BMC&sigh=6T9VeSpgXyg&template_id=484&tpd=AGWhJmseOJLEpI39Fm3dNu9qLUc4NIWa5XyOVTlxiRywILHYkw
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

/
nir.theregister.co.uk/
0
137 B
Script
General
Full URL
https://nir.theregister.co.uk/?s=sa/oid.103114299
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:41 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
5736c3681d96ce2b-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy02gb
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
13383715393910617290
tpc.googlesyndication.com/simgad/ Frame 2186
110 KB
111 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/13383715393910617290
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
56a8a0e5b7d5de2c3b93f928a2f761edaa9185c26cd72c716c711c9add00fd89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 12 Mar 2020 13:10:09 GMT
x-content-type-options
nosniff
age
94472
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
113122
x-xss-protection
0
last-modified
Tue, 07 Jan 2020 11:33:12 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 13:10:09 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2186
0
291 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssRnGRlb3XFxidQ3CtkE7dWTaZ2qmgygOSpLFXmHxXBOjWIYarzlzwi1mD8bHkG7psrCncFUo8jUXv8tD0m9DWBMb4hpqhJtj3-b9GLH_mzmXI28U9A6aDihPHrChVyoqIIZWRGetttWpNoxdLAkLgey_YDYdRbP5fYYm9DGcRQ806pE8s5WqvWT77YyJ5oii0sLTPBXrkLiIckzFR-Vvb_dsXoCqCYY2NQjStdP0hd67NEjyjRMFPMhV7xovh06ztksfwfgPXBygB2HGUw7FA6bA&sai=AMfl-YSkpExtp1yzjxshvH3-1r4kDeHB6gNl0efQ5Er4vNeyLOZ8ZPYCNoRFZC7PmGvEp1ePjRRrmNwgsOPFAvK5gsTs4nvQkzSdBVro3z48Sg&sig=Cg0ArKJSzDFLlqLUAhDIEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 15:24:41 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:41 GMT
10723475537796701915
tpc.googlesyndication.com/simgad/ Frame 070F
17 KB
17 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/10723475537796701915?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkfUbKz0lV5p0nKNkG-MYRPEkikyA
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1800812f997a0ea3bc92e069b931e2530afbce58ac24fc06c0cd69dc97763b08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 11 Mar 2020 00:05:04 GMT
x-content-type-options
nosniff
last-modified
Mon, 10 Feb 2020 15:43:37 GMT
server
sffe
age
227977
content-type
image/png
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
17674
x-xss-protection
0
expires
Thu, 11 Mar 2021 00:05:04 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 070F
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 11:08:58 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
15343
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Sat, 14 Mar 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 070F
295 B
357 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 12:55:21 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
8960
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Sat, 14 Mar 2020 12:55:21 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 070F
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CUMikuaVrXoCaBIWV3wOI5pzACJWTgZBckt-S6LQLFBABINaH8xNgu76ug9AKoAHeruiaA8gBAqkCsIA5n6cRtT7gAgCoAwHIAwiqBIwCT9AYdHI2yFa91ueDgQxM2HhL2Sq5KApYv3suNAzCtFbMljyS6mzUvZHNxjjDA3XA0SgdrysnQWj10yMz5ueQXGrSCh402Y6-PTUuxZAwP6lP5SfUYmqDCbBBaGV5eKMOQTwuJTHJ2P165hrbYfMfWAFtfNS-SSD2nm_03P4HRVoBwaSI1erxyH2ZtAFLaNn4NpVSA2bA_P9jsZUkAPj6vgSgraW4-qwxmk4nBdPeDhEeY-qyrqxPfkStLuvgb_ymbwZxdSsjqnKkYB5j5EIfT6An5DgFXNmALRaV_8C3Lw2Eoj7vMFw2Yx6VzOCXs-i8vzmNsiunARQaxtzQMQQGSLh8rnn4DiJ9V80AMcAErq76qOkC4AQBkgUECAQYAZIFBAgFGASgBgKAB4rRl2WoB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCy-wLSCAkIgOGAEBABGB2ACgPICwHYEww&sigh=z7HZNrfv8ns&tpd=AGWhJmvo7yURGrsOy7DXzUxorl-Z2v1T2AyNavtUuKgGqd41-g
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

3182644167649536124
tpc.googlesyndication.com/simgad/ Frame D19E
9 KB
9 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/3182644167649536124?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmKBMHwuthBlcs8rZzyxVJ-Exj9Ag
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
342ee33ef92100acb3ca95d9c1dff08de1b02ef291abadab97fe662dfce7d729
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 28 Feb 2020 17:09:06 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Feb 2020 08:20:38 GMT
server
sffe
age
1203335
content-type
image/png
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9095
x-xss-protection
0
expires
Sat, 27 Feb 2021 17:09:06 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D19E
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 11:08:58 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
15343
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Sat, 14 Mar 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D19E
295 B
357 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 12:55:21 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
8960
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Sat, 14 Mar 2020 12:55:21 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame D19E
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CtQEHuaVrXoGaBIWV3wOI5pzACLjFw_9bvIvErugKmJL4h7MCEAEg1ofzE2C7vq6D0AqgAdPx-coDyAEC4AIAqAMByAMIqgSGAk_Q2Juz4JEJMS43Ie8WshRzXYswErJ8FwjAgjWozWOpHZSYPsbZiSriTkV1MPm-mSjiV-THQhBxaT8Hqj8pUdLa1jg0RifAGoufXr5NuFsYMtyMGTrED4bXRy2k--ryLyKlj3tzOvNWWh7-J7qs9ARu8_DJ3pt02acRWpHHdPD4be7LQ_t5Gjh-8GnNS46P4ePtD6NL0m5vOmxB3pnH5bc0hDSdX9i9G6dtkQefuovnvH6_QkHcJsGzV3-baQjfHe6G-0URK5NlsZ7E4NhfBiTSJJ0ArDOjqoQca6ckinhfEAk2KA3WpcaEvzi7zo5SeOnJzoLHmCa6aQEt5gXJRxHXB0vMWzjABOT7p-SJA-AEAaAGAoAHirH0pAGoB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCVuwTSCAkIgOGAEBABGB2ACgPICwHYEwM&sigh=1Jxl8RtbAYM&tpd=AGWhJmte9YZDda3lghWTJSjjgLfCFj9-x4hsuSg3aIoijYoUiw
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s18-in-f98.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

sodar
pagead2.googlesyndication.com/getconfig/
7 KB
5 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
de90ece9c9ed3cb628c4ac1a87ebe953b03bb5a348571fd2aadf18dab7bee379
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 13 Mar 2020 15:24:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5191
x-xss-protection
0
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 7E14
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 05 Mar 2020 03:21:18 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
734603
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11180
x-xss-protection
0
expires
Fri, 05 Mar 2021 03:21:18 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 7E14
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 31 Jan 2020 00:50:19 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
3681262
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11020
x-xss-protection
0
expires
Sat, 30 Jan 2021 00:50:19 GMT
sodar2.js
tpc.googlesyndication.com/sodar/
14 KB
5 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065699
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 13 Mar 2020 15:24:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1582746470043195"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
5456
x-xss-protection
0
expires
Fri, 13 Mar 2020 15:24:41 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 070F
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date
Fri, 13 Mar 2020 15:24:41 GMT
x-content-type-options
nosniff
server
safe
location
https://googleads.g.doubleclick.net/pagead/drt/si
content-type
text/html; charset=UTF-8
status
302
cache-control
private
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
246
x-xss-protection
0
si
googleads.g.doubleclick.net/pagead/drt/ Frame D19E
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date
Fri, 13 Mar 2020 15:24:41 GMT
x-content-type-options
nosniff
server
safe
location
https://googleads.g.doubleclick.net/pagead/drt/si
content-type
text/html; charset=UTF-8
status
302
cache-control
private
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
246
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 9E63
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/209/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
5727
date
Fri, 13 Mar 2020 14:24:08 GMT
expires
Sat, 13 Mar 2021 14:24:08 GMT
last-modified
Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3633
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
8728516385599933421
tpc.googlesyndication.com/simgad/ Frame 67BE
15 KB
15 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/8728516385599933421
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c28973c56e429444d5090977230c2a2da792d865a4aacd6a6b30900cfb0cfe7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 12 Mar 2020 13:01:53 GMT
x-content-type-options
nosniff
age
94968
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15796
x-xss-protection
0
last-modified
Tue, 07 Jan 2020 11:33:12 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 13:01:53 GMT
13383715393910617290
tpc.googlesyndication.com/simgad/ Frame 2186
110 KB
111 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/13383715393910617290
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
56a8a0e5b7d5de2c3b93f928a2f761edaa9185c26cd72c716c711c9add00fd89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 12 Mar 2020 13:10:09 GMT
x-content-type-options
nosniff
age
94472
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
113122
x-xss-protection
0
last-modified
Tue, 07 Jan 2020 11:33:12 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 Mar 2021 13:10:09 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E14
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 11:08:58 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
15343
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Sat, 14 Mar 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E14
295 B
360 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 12:55:21 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
8960
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Sat, 14 Mar 2020 12:55:21 GMT
10723475537796701915
tpc.googlesyndication.com/simgad/ Frame 070F
17 KB
17 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/10723475537796701915?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkfUbKz0lV5p0nKNkG-MYRPEkikyA
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1800812f997a0ea3bc92e069b931e2530afbce58ac24fc06c0cd69dc97763b08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 11 Mar 2020 00:05:04 GMT
x-content-type-options
nosniff
last-modified
Mon, 10 Feb 2020 15:43:37 GMT
server
sffe
age
227977
content-type
image/png
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
17674
x-xss-protection
0
expires
Thu, 11 Mar 2021 00:05:04 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 070F
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 11:08:58 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
15343
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Sat, 14 Mar 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 070F
295 B
360 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 12:55:21 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
8960
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Sat, 14 Mar 2020 12:55:21 GMT
3182644167649536124
tpc.googlesyndication.com/simgad/ Frame D19E
9 KB
9 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/3182644167649536124?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmKBMHwuthBlcs8rZzyxVJ-Exj9Ag
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
342ee33ef92100acb3ca95d9c1dff08de1b02ef291abadab97fe662dfce7d729
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 28 Feb 2020 17:09:06 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Feb 2020 08:20:38 GMT
server
sffe
age
1203335
content-type
image/png
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9095
x-xss-protection
0
expires
Sat, 27 Feb 2021 17:09:06 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D19E
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 11:08:58 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
15343
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2502
x-xss-protection
0
expires
Sat, 14 Mar 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D19E
295 B
360 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 13 Mar 2020 12:55:21 GMT
x-content-type-options
nosniff
content-type
image/png
server
cafe
age
8960
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Sat, 14 Mar 2020 12:55:21 GMT
tp.gif
regmedia.co.uk/2007/09/13/
Redirect Chain
  • https://go.theregister.co.uk/k/abt_a
  • https://regmedia.co.uk/2007/09/13/tp.gif
34 B
502 B
Image
General
Full URL
https://regmedia.co.uk/2007/09/13/tp.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Mar 2020 15:24:42 GMT
cf-cache-status
HIT
age
74957
cf-polished
origFmt=gif, origSize=49
cf-ray
5736c36acb7ad719-FRA
status
200
content-disposition
inline; filename="tp.webp"
cf-bgj
imgq:85
content-length
34
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 13 Sep 2007 11:17:03 GMT
server
cloudflare
etag
"31-43a027a4c29c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Wed, 07 Apr 2021 15:24:42 GMT

Redirect headers

cf-ray
5736c36a9c4ece2b-LHR
date
Fri, 13 Mar 2020 15:24:42 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://regmedia.co.uk/2007/09/13/tp.gif
content-type
text/html; charset=iso-8859-1
status
302
x-reg-bofh
pfy02gb
content-length
310
gen_204
pagead2.googlesyndication.com/pagead/
0
67 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=2283115455564837&bg=!lZallo5YcIfjuOvdc7cCAAAARlIAAAALmQFhCMYmz_On4T5vjLitQ9DkleXYuf1mWEw9YNdN4HoS0o-QjJNkidEBgxkuMFPPCtcRJ8dsaUxIrlfITlMlOV4LyF_ozheN7S1cOvIzrjcXid-UxHuVb4jpyCmWV534vuEJjMhDq8COLIYU0foQ-D7-lKUJdZJnfRY7_3USCyfDZKnUJP8QZU9DtJ5Pz3xrWDelHppFKrBPIQY5CnAF74lUvSPK5kWNJGWggvQynfNBlOHEe2BRjrb1BH9TZltpnvt8QLRg6q-6eNmzOoPLM0cTzhiq02pzmuJw25a6sf0g22_pWjfMHu1Zp7gr-ItKdpAPkfSyAybDsIuKpJXQSC6hzkPRnBwKS9MW2Ew4WxkNcdW1J6xo7vyFxbIUpTEkJZb6IG9N-i2w1rFj5ZQhxlqUR6WgNmy2cx5Lc0QrMNj5mCk5ihURfJzBd1XUT7ODTSNfpHgWDlGv4aKdfK57rkg_FX8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:42 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 67BE
42 B
121 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstJA8ACxU5j0qpenUJEzT8Sh8N7OZpt_ky89ULA-CSKcAj_hEnEvDwevQvqpDVmT2K1IPAXIMryxZ5ZCTbybf-CFAnGAipo7Lbbks3EcBo&sig=Cg0ArKJSzDaQ0yNS2JYkEAE&id=ampim&o=429,129&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=188&tls=1189&g=100&h=100&tt=1189&r=v&adk=284626583&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:42 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 2186
42 B
119 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstRACo67U6LL0X7OizfKac5pDL8DiJ5l_myh9yZ9iaVvzSkBHjU-f6wxnPdEBWskRwbMH9gvRBN9LrolKxUeoA5Fh9QNbNCxRm46bvYBuU&sig=Cg0ArKJSzJW76lIvgxunEAE&id=ampim&o=978,233&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=191&tls=1191&g=100&h=100&tt=1191&r=v&adk=2610646818&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 13 Mar 2020 15:24:42 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads.js
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/
27 B
269 B
XHR
General
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/72fc1bd4030a25dd799a3273496c75f4100a940e/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 13 Mar 2020 15:24:45 GMT
cf-cache-status
HIT
age
13595085
cf-ray
5736c3831951ce2b-LHR
status
200
content-length
27
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 05 Apr 2018 12:48:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy04
expires
Wed, 07 Apr 2021 15:24:45 GMT

Verdicts & Comments Add Verdict or Comment

164 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| RegZoot object| RegCC string| RegPageType string| RegTruePageType object| RegArticle function| sprintf object| RegUtils object| RegCBW string| _RegCBWTest function| RegCBWA function| RegCBWT boolean| is_rows_based_page function| ads_states_tracking boolean| RegAST function| track_abt function| gpt_js_errored function| bird_alternative function| init_gpt function| ad_free function| show_article_signup_ml function| RegTLRotate function| load_media_player function| pivot_shuffle function| pivot_around function| display_social_popup function| regtld function| getElementCss function| setElementCss function| getElementHeight function| moveElement function| account_form_check function| need_account_refresh function| log_account_refresh_response function| get_epoch function| rolling_time function| time_calc function| get_url_param function| reg_nl_form function| scale_article_inner_elems function| toggle_account_tab_state function| resize_img_url function| send_to_analytics function| NO_DEV_COOKIE function| isScrolledIntoView function| check_rhs_sticky_ads_general_conditions function| rhs_sticky_ad_mu1_spot function| isIE function| spawn_and_load_img_from_div undefined| sticky_ad_RT_2F function| rhs_sticky_ad_btn_spot function| augment_promo_unit function| social_button_share function| sticky_nav_bar function| add_search_terminal function| nav_bar_search function| nav_popup function| article_body_safe_spots_for_ads function| is_article2article function| RegSendGA object| rat_ function| track_bucket_user function| performance_stats function| send_performance_stats number| RegPerformanceStatsPerMille function| setup_forum_votes function| RegSponsorship function| RegSponsorshipChan function| RegParallax function| RegMobParallax function| HideRegBotBanner function| RegBottomBanner function| polling function| polling_setup function| poll_view_results function| render_thanks function| equalize_poll_vote_count_width function| render_poll function| append_view_btns function| poll_view_btn function| render_poll_question function| render_poll_result function| get_poll_votes function| update_poll_votes function| move_poll_question function| submit_poll_votes number| vplayer_count function| slideshow function| slideshow_setup function| load_slide_rail function| load_slide_img function| load_slide_image function| slide_img_v_alignment function| load_slide_video function| slideshow_user_events function| get_slideshow_id function| get_slide_index function| slide_change_request function| change_slide function| change_rail_images function| rail_size function| slideshow_pos function| set_slideshow_video_size function| slide_arrow function| full_youtube_url function| youtube_thumb_img function| $ function| jQuery object| nir object| s object| googletag string| Reg__adct object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| RegWpTl string| RegABTest string| GoogleAnalyticsObject function| ga object| adm object| sticky_nav object| jQuery1112022357782580162366 object| VCs object| VKs object| VVCCs object| SAs object| google_tag_data object| gaplugins object| gaGlobal object| gaData number| google_srt undefined| google_measure_js_timing string| RegSection object| admCustomData string| sc string| axc number| __google_ad_urls_id number| google_unique_id boolean| RegAdBlocking function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| RegAdsRendered object| GoogleGcLKhOms function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP object| google_image_requests

6 Cookies

Domain/Path Name / Value
.theregister.co.uk/ Name: sc
Value: 1
.theregister.co.uk/ Name: _gat
Value: 1
.theregister.co.uk/ Name: _ga
Value: GA1.3.834316154.1584113081
.theregister.co.uk/ Name: bucket
Value: 464
.theregister.co.uk/ Name: _gid
Value: GA1.3.1237704130.1584113081
.theregister.co.uk/ Name: __cfduid
Value: d61f1e389cb3e5512e8b0d3124e60fabc1584113080

5 Console Messages

Source Level URL
Text
console-api info URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2002251816300 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api info URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2002251816300 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api info URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2002251816300 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api info URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2002251816300 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/
console-api info URL: https://cdn.ampproject.org/rtv/012002251816300/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2002251816300 https://www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

11043ed952c1f188ee59af40171ba6b6.safeframe.googlesyndication.com
5f0ab371126819f126035e749d6e70b0.safeframe.googlesyndication.com
6005eeeb17bb901c1a936f348cffa880.safeframe.googlesyndication.com
632d3519b683c119b8dfe7c0ad2f6d84.safeframe.googlesyndication.com
adservice.google.co.uk
adservice.google.com
c9f61e66ac8b18e5752d6f521711aaef.safeframe.googlesyndication.com
cdn.ampproject.org
e3df9258692d254ffd61805e6baffdd1.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
go.theregister.co.uk
googleads.g.doubleclick.net
nir.theregister.co.uk
pagead2.googlesyndication.com
pj.l.admedo.com
regmedia.co.uk
securepubads.g.doubleclick.net
stats.g.doubleclick.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.theregister.co.uk
104.18.235.86
13.224.194.67
172.217.22.98
2606:4700::6810:5451
2a00:1450:4001:808::2001
2a00:1450:4001:808::2003
2a00:1450:4001:808::2004
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a00:1450:4001:81a::2001
2a00:1450:4001:81b::2002
2a00:1450:4001:81c::2001
2a00:1450:4001:81c::200e
2a00:1450:4001:820::2002
2a00:1450:4001:821::2001
2a00:1450:400c:c00::9c
00a90076624308d96229a561974d2d72398e2d48e4a8e9dbdcf178904014aac6
01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
07d1b5f6b5b02c8d91f22f6c0e837c7649a7a144035c30dafab3ebbd663059b1
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
1800812f997a0ea3bc92e069b931e2530afbce58ac24fc06c0cd69dc97763b08
182d1155257f38f4cb3c981791932f618848901ae5ca032f3fe256dac200002b
1bc9eeec7ba19c97ba1d50c10195c3f74302af5e712409e51e5b8d35b6f46eb8
1c28973c56e429444d5090977230c2a2da792d865a4aacd6a6b30900cfb0cfe7
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211
2c9a6e7c16ce382aa1be3468a5cfb2225649a40c8fec610d4f75d1ee54090789
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15
2d6878e28cd2fb1b94e3bc629a2267fcbba0a1604a99bf079640ca85a13caa78
2ef0229dbf3b245afa2fbd209ce7dba56323bcafc380f4ba46b112519bc94641
342ee33ef92100acb3ca95d9c1dff08de1b02ef291abadab97fe662dfce7d729
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
363edeba1963685d08a885c613f43fd3c94fa0ba6cea87de6036f960c9d38717
3daac55ae8e37e4d6eabd36903eaa318ead4759b398faff5ac5814cda3d13b14
42b5b6a0977d8fc7c75afb12e5a0bf066663b2ef4fe16a4310f965c0d3bcf136
449bb084a71158da5d9ae64d5cf3c250f5614a0ada0cc4acb47c23dd4e896763
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892
52a099f3b2c31bf42c37aff7f27c13b00e2dd36acd05a2a413ab67c04d5ac362
56a8a0e5b7d5de2c3b93f928a2f761edaa9185c26cd72c716c711c9add00fd89
5b040cd620ed6482975472e60c4e67309a9375395a53aa7cba72489b76d61545
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace
63deef7c108a190fd0bd1a2a45f1a9e74c6402a77b39632c45e664cc615b2672
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33
67ebf1b15c9432153a2cbab9257cd24fff3c661e39e65f3558536bbefae27ae0
6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a
71651da4a0daf06bf487005c930c6fdbce983c32fe49e23c84689ee54bc95ec2
76ebd2a7078570fa9f6a50855b4ade57c6b558cca7c95801b2b247406b274975
7af1368aae8746606ac38123c548eeaa7d330c50b1d9f27a167f06c88009c382
7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
890ed0141e72fffa470e0fdef4dbe9043b01e116ba763dd858a5100b05a9c072
8cebbfa1487e3dc67737bb93e04d96fef483b4b69cd67707d0cb4817e09a4335
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d
9876c8c8bbe2d52581e1a42d5b440e4f776769a90f24f1d8d847a2d09b0609bb
98aeedb0588e7ae50a4907abb353ef409dcf215cd35153f610e14f784a08ea90
9a7e49fb41c1175f9d4e394b6fe993af1b657150e53115b86b7e410a4aad4985
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
b081c8d9b69d7b76779e033f58d9c0f79a254ecce6e2f18db0676090edad3b18
b746fd6fd6ff3d97dcc04fcc7906d3de2d9ba7a04d28ee2d391fb3a43d152ebf
c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed
c518bb3d731d8a3ef8c15323d9a1944d1ae6d6be8e92b8a65c9cae7d0241ebe8
cd8237eb5b0960c24d820d8ac24f6882c8edcd9567587ce8eff968c707321a11
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7
ce79e943415d0166d579f967dd7f559b019269e09d6edc41e6adb8a8ff669b31
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
d8db699e718814dce4d71b8c7d981df5aed9df3d3b49eb5d8970c3f75c2547ad
d9ab3b31a7fdf53823cbeb2b3b47a6c0152fd93cb0891659614db33645cb34ce
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08
de90ece9c9ed3cb628c4ac1a87ebe953b03bb5a348571fd2aadf18dab7bee379
dffd83700dd74d4524da45259085e0a134e06e87b4fe5b7fdf77134269da81ae
e099a9372c5c120a9e0ba1136dd283513937bedf9cca34b88300132cf585341c
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e57c9bc67a827ad246d31b9e24e71d6574e54c00e06e875a8aa83063fe50692d
e64701668bca96d27f23530ca9631ef8b27a0e5ffe6bc39d8c54631f79bff14c
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a
ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9
ea9766ee93dea33e983794ed004d0b336dbcdd33383da07e011faaa1f1875b42
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c
f6066bf2c450c62b02fc04e3348ec6d7835c6fe2b429424c000aa0242a1929d9
f6f77831a67ab9537e390ad6a3f6f0430a1f68911b2c4cbd28f91e8aa0916138
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27
f7fe3424135288c8b6ef9fcd0843e1951de48403763be4a56dc4484574775bc5
fbb0837329b8e5d40a6f9da4ba0b3e7919112e2d709cef2b66557529f0983fc0
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc