threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04
Effective URL:
https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqt...
Submission: On December 16 via api (December 16th 2020, 12:12:38 pm UTC) from DE

Summary HTTP 236 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 54 IPs in 8 countries across 44 domains to perform 236 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	199.60.103.254 199.60.103.254	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	65.9.96.62 65.9.96.62	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:e0:... 2606:4700:e0::ac40:621c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 22	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:205... 2600:9000:2057:8400:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2600:9000:214... 2600:9000:214f:2800:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 11	2a00:1450:400... 2a00:1450:4001:814::2004	15169 (GOOGLE) (GOOGLE)
9	172.217.21.226 172.217.21.226	15169 (GOOGLE) (GOOGLE)
3	65.9.86.127 65.9.86.127	16509 (AMAZON-02) (AMAZON-02)
1 17	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2003	15169 (GOOGLE) (GOOGLE)
2 8	185.33.221.13 185.33.221.13	29990 (ASN-APPNEX) (ASN-APPNEX)
2 4	216.52.2.48 216.52.2.48	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
4	69.173.144.141 69.173.144.141	26667 (RUBICONPR...) (RUBICONPROJECT)
5	213.19.147.210 213.19.147.210	26120 (RHYTHMONE) (RHYTHMONE)
5	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
3	136.144.59.88 136.144.59.88	54825 (PACKET) (PACKET)
5	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
1 9	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
5	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	18.196.13.179 18.196.13.179	16509 (AMAZON-02) (AMAZON-02)
1	167.172.1.14 167.172.1.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	34.255.243.34 34.255.243.34	16509 (AMAZON-02) (AMAZON-02)
1	64.140.160.2 64.140.160.2	18450 (WEBNX) (WEBNX)
3	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	199.232.52.157 199.232.52.157	54113 (FASTLY) (FASTLY)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
11	18.218.223.45 18.218.223.45	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:81d::2001	15169 (GOOGLE) (GOOGLE)
1	2600:9000:212... 2600:9000:2127:c000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:817::2003	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:81f::2001	15169 (GOOGLE) (GOOGLE)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	2620:1ec:bdf::13 2620:1ec:bdf::13	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	134.209.131.220 134.209.131.220	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
3	151.101.13.108 151.101.13.108	54113 (FASTLY) (FASTLY)
1 2	18.192.150.244 18.192.150.244	16509 (AMAZON-02) (AMAZON-02)
1	184.24.15.122 184.24.15.122	16625 (AKAMAI-AS) (AKAMAI-AS)
3	104.108.145.8 104.108.145.8	16625 (AKAMAI-AS) (AKAMAI-AS)
3	104.108.144.214 104.108.144.214	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2	3.123.45.128 3.123.45.128	16509 (AMAZON-02) (AMAZON-02)
1 1	52.210.128.165 52.210.128.165	16509 (AMAZON-02) (AMAZON-02)
4 5	52.28.254.214 52.28.254.214	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1 3	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
236	54

2 199.60.103.254 (Canada) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., GB)

info.silobreaker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 65.9.96.62 (Seattle, United States)

ASN16509 (AMAZON-02, US)

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:e0::ac40:621c (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2057:8400:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:214f:2800:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:814::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.217.21.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s13-in-f226.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.9.86.127 (Seattle, United States)

ASN16509 (AMAZON-02, US)

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 151.101.194.137 (United States) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.33.221.13 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.52.2.48 (United States) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.141 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 213.19.147.210 (United Kingdom)

ASN26120 (RHYTHMONE, US)

tag.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States)

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 136.144.59.88 (United States)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.215.135 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 35.244.159.8 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.13.179 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-13-179.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.1.14 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.243.34 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.140.160.2 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com

geo.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.52.157 (United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 18.218.223.45 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-218-223-45.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ad313c47c975dc9b795684fdc862df28.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:81d::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:c000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:81f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::13 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.209.131.220 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.13.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.192.150.244 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-150-244.eu-central-1.compute.amazonaws.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.24.15.122 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-24-15-122.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.108.145.8 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-145-8.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.108.144.214 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-144-214.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.123.45.128 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.128.165 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-128-165.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.28.254.214 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.156.0.31 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	523 KB
29	googlesyndication.com ad313c47c975dc9b795684fdc862df28.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	470 KB
28	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	2 MB
14	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	123 KB
13	google.com 2 redirects www.google.com adservice.google.com	2 KB
12	advertising.com 4 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	3 KB
11	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	9 KB
11	adlightning.com tagan.adlightning.com	242 KB
10	ampproject.org cdn.ampproject.org	194 KB
9	openx.net 1 redirects teachingaids-d.openx.net eu-u.openx.net u.openx.net	2 KB
8	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	351 B
7	casalemedia.com 1 redirects htlb.casalemedia.com ssum.casalemedia.com	3 KB
7	admetricspro.com qd.admetricspro.com	291 KB
5	1rx.io tag.1rx.io	1 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	7 KB
5	googletagservices.com www.googletagservices.com	132 KB
4	lijit.com 2 redirects ap.lijit.com	2 KB
3	yahoo.com 1 redirects ups.analytics.yahoo.com	3 KB
3	indexww.com js-sec.indexww.com
3	google.de adservice.google.de www.google.de	445 B
3	google-analytics.com www.google-analytics.com	19 KB
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	785 B
3	a-mo.net prebid.a-mo.net	1011 B
3	amazon-adsystem.com c.amazon-adsystem.com	34 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	486 B
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
2	servenobid.com ads.servenobid.com public.servenobid.com	3 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
2	silobreaker.com 1 redirects info.silobreaker.com	3 KB
1	adsrvr.org 1 redirects match.adsrvr.org	582 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	googleadservices.com partner.googleadservices.com	394 B
1	twitter.com analytics.twitter.com	651 B
1	t.co t.co	448 B
1	quantcount.com rules.quantcount.com	356 B
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	584 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	ipify.org geo.ipify.org	1 KB
1	gstatic.com www.gstatic.com	131 KB
1	youtube.com www.youtube.com
1	googletagmanager.com www.googletagmanager.com	50 KB
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
236	44

	Domain	Requested by
20	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
17	threatpost.com	info.silobreaker.com threatpost.com
11	vid.connatix.com	cd.connatix.com
11	capi.connatix.com	cd.connatix.com
11	www.google.com	2 redirects threatpost.com tagan.adlightning.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
10	cdn.ampproject.org	threatpost.com
8	pagead2.googlesyndication.com	tagan.adlightning.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
8	ib.adnxs.com	2 redirects qd.admetricspro.com cds.connatix.com
8	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
8	media.threatpost.com	threatpost.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
7	qd.admetricspro.com	threatpost.com qd.admetricspro.com
5	pixel.advertising.com	4 redirects
5	hbopenbid.pubmatic.com	qd.admetricspro.com cds.connatix.com
5	teachingaids-d.openx.net	qd.admetricspro.com cds.connatix.com
5	htlb.casalemedia.com	qd.admetricspro.com cds.connatix.com
5	adserver-us.adtech.advertising.com	qd.admetricspro.com
5	tag.1rx.io	qd.admetricspro.com cds.connatix.com
5	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
4	googleads.g.doubleclick.net	tagan.adlightning.com threatpost.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
4	ap.lijit.com	2 redirects qd.admetricspro.com
3	ups.analytics.yahoo.com	1 redirects
3	ads.pubmatic.com	qd.admetricspro.com cds.connatix.com
3	js-sec.indexww.com	qd.admetricspro.com cds.connatix.com
3	acdn.adnxs.com	qd.admetricspro.com cds.connatix.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	prebid.a-mo.net	qd.admetricspro.com
3	cds.connatix.com	threatpost.com tagan.adlightning.com cd.connatix.com
3	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com
2	sync-tm.everesttech.net	2 redirects
2	u.openx.net	cds.connatix.com
2	ads.adaptv.advertising.com	cds.connatix.com
2	ssum.casalemedia.com	1 redirects
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	eu-u.openx.net	1 redirects qd.admetricspro.com
2	img.connatix.com	threatpost.com
2	adservice.google.com	tagan.adlightning.com
2	adservice.google.de	tagan.adlightning.com
2	info.silobreaker.com	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	match.adsrvr.org	1 redirects
1	eus.rubiconproject.com	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	public.servenobid.com	qd.admetricspro.com
1	partner.googleadservices.com	tagan.adlightning.com
1	analytics.twitter.com	tagan.adlightning.com
1	pixel.quantserve.com	threatpost.com
1	www.google.de	threatpost.com
1	t.co	threatpost.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	rules.quantcount.com	secure.quantserve.com
1	ad313c47c975dc9b795684fdc862df28.safeframe.googlesyndication.com	tagan.adlightning.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	geo.ipify.org	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	tlx.3lift.com	qd.admetricspro.com
1	www.gstatic.com	www.google.com
1	www.youtube.com	threatpost.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	cd.connatix.com	1 redirects
236	69

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
youtu.be
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
info.silobreaker.com Cloudflare Inc ECC CA-3	`2020-06-30` - `2021-06-30`	a year	crt.sh
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.1rx.io Sectigo RSA Domain Validation Secure Server CA	`2019-06-28` - `2021-06-27`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.a-mo.net Let's Encrypt Authority X3	`2020-11-12` - `2021-02-10`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-11-02` - `2021-01-30`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-10-02` - `2021-04-02`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
*.google.de GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-29` - `2021-04-14`	5 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-10-04` - `2021-03-31`	6 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-10-24` - `2021-04-20`	6 months	crt.sh

This page contains 32 frames:

Primary Page: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Frame ID: D39544811427EA2A5C80A8023D7CF962
Requests: 105 HTTP requests in this frame

Frame: https://cds.connatix.com/p/84835/connatix.player.dc.js
Frame ID: 98AA37178A643EEF942F39E5C467AFAB
Requests: 45 HTTP requests in this frame

Frame: https://www.youtube.com/embed/pPyTJO5c4_U?feature=oembed
Frame ID: D2D7F31D15F783D6A30B09F010FD027D
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&theme=standard&size=normal&cb=66rxs4i387s0
Frame ID: B1DB4E61B77AEF76CE20054ADE5CE33C
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&theme=light&size=normal&cb=88e9wr5sxfkk
Frame ID: A5E86D4E24C20FC4DB7CFAF34D8AFF14
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=h9geuuk351na
Frame ID: 8448AB51838BD2CF191F580FF96B0976
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=fz1jk9tityxi
Frame ID: 0E3FDBC6F4299A218D345BAE7E7A3A96
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Frame ID: 0769F3D21C1151BF72086B27960DAF56
Requests: 18 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Frame ID: AD3F9823E2838C39DC977D616DFE578E
Requests: 17 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Frame ID: 538AF347781C746DB6E0E53AC5069C86
Requests: 15 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Frame ID: E7BD91AFC11162BA6C479E268B1525A8
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/zrt_lookup.html
Frame ID: 3928C13C50FD821E2AF82BB2300806F8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186319&pi=t.ma~as.7785652766&w=300&fwrn=3&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ea=0&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1608120738944&bpp=113&bdt=2343&idt=1020&shv=r20201203&cbv=r20190131&ptt=9&saldr=aa&correlator=6519220517039&frm=23&ife=4&pv=2&ga_vid=371802538.1608120740&ga_sid=1608120740&ga_hid=1983266361&ga_fc=0&nhd=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1082&ady=1758&biw=1600&bih=1200&isw=300&ish=600&ifk=2061636368&scr_x=0&scr_y=0&eid=21066699%2C21066792%2C182982000%2C182982200%2C21067982&oid=3&pvsid=1263228587710794&pem=492&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.uaxq83623l63&btvi=1&fsb=1&dtd=1240
Frame ID: 6B78EE1924998054EC133C8289733A39
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: D40FF579427C8EAC2E153E2BCFC0B1D4
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 1EBA97AF3835EA50A21BCB662A4372C1
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: DB7512DF07C483057BAFD1341E8F9C0D
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Frame ID: EF809500803921C9471FD37B6DD3F815
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 38DC242C77433892BDB8C01A74483027
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 7339D89F60243B72B4892EC29AB9D4CA
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: FFABDC13C47BB423F7517F7372B6A32C
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 0D9FD418803853B1A576A03536932BBD
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 096F5A65499B5A4E98F7A2CC061EAA1F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: E3BCFA28CBC2A0E5F2E6878960F57BA5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: 6D79CE0C907AE679A0D279926D691253
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 7E61E6EBFDF69124D6A2612DD33B2480
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: A9F813BFC3C7B57FBB296D412F6FEDE9
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: AED66605F19EF5B01D315E8BE5DAD2CB
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: F70DE59D91407012F8971A4149CA8333
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 58335C3046BB0F20959D34377696FE82
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: D85B26F6D1DAB3F7400DE1862B973C73
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 3B18257FB8EFA9485C70C3843CB2C8D0
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 470754A79BBBA5F9612A062CF585541F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04 Page URL
https://info.silobreaker.com/events/public/v1/track/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkg... HTTP 307
https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

236
Requests

100 %
HTTPS

36 %
IPv6

44
Domains

69
Subdomains

54
IPs

8
Countries

3846 kB
Transfer

8425 kB
Size

4
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://youtu.be/pPyTJO5c4_U
Title: Watch the full ThreatpostNOW video interview with Beau Woods, below:

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23ransomware
Title: #ransomware

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23COVID19
Title: #COVID19

Search URL Search Domain Scan URL

URL: https://t.co/DTcnzxKB0a
Title: https://t.co/DTcnzxKB0a

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04 Page URL
https://info.silobreaker.com/events/public/v1/track/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04?_ud=e88af5ea-b0b8-49ab-99c3-23326647a849&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/84835/connatix.player.dc.js

Request Chain 152

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 157

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 174

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0 HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0

Request Chain 176

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 177

https://ap.lijit.com/beacon?informer=13394437 HTTP 302
https://ap.lijit.com/beacon?informer=13394437&dnr=1

Request Chain 179

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 183

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D296a6f96-52f9-4c99-ad9f-823c83c2b237%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=appnexus&uid=7015098911700843152

Request Chain 184

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=sovrn&uid=3e39941db8ed42518c5385bd

Request Chain 185

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1

Request Chain 220

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9

Request Chain 221

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X9n5qwAAALbJDToG&_origin=0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG HTTP 302
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X9n5qwAAALbJDToG&_origin=0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8

Request Chain 222

https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true HTTP 302
https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVBmNjVkYjU4Ni0zZjk3LTExZWItOWM5OC0wNmY5MzgxMjRjZTg%3D HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEJ6t3BEMAq4ZuBN7o2KMP8M&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJ6t3BEMAq4ZuBN7o2KMP8M&google_cver=1&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8

236 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04 Show response
info.silobreaker.com/e2t/sc2/ 7 KB
2 KB 141ms
74ms Document
text/html 199.60.103.254
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.60.103.254 , Canada, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., GB),
Reverse DNS
Software: cloudflare /
Resource Hash: 42a28e8bcde265c93b74fa93f7928ee58a735be5b1efb9b9682e3a61aca9ce13

Request headers

:method: GET
:authority: info.silobreaker.com
:scheme: https
:path: /e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:11 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=d1ed194bbc209a4a302a12ebf63d392db1608120730; expires=Fri, 15-Jan-21 12:12:10 GMT; path=/; domain=.info.silobreaker.com; HttpOnly; SameSite=Lax __cfruid=4ec6653ee562beb2bb0438690f8ddfae9586a4ef-1608120731; path=/; domain=.info.silobreaker.com; HttpOnly; Secure; SameSite=None
cf-ray: 60284fa8abe9082c-CDG
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 070d101d6e0000082cf80ae000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
server: cloudflare
content-encoding: br

GET
H/1.1

200
OK

Primary Request / Show response
threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/
Redirect Chain

https://info.silobreaker.com/events/public/v1/track/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04?_ud=e88af5ea-b0b8-49ab-99c3-23326647a849&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p
https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLI...

96 KB
27 KB

934ms
619ms

Document
text/html

35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Requested by

Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

70c12ab3bce8a60d010804548e22540ea9a000400f9c7266c6eb18313714d347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04

Response headers

Server: nginx
Date: Wed, 16 Dec 2020 12:12:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/162247>; rel="alternate"; type="application/json" <https://threatpost.com/?p=162247>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS
Content-Encoding: gzip

Redirect headers

date: Wed, 16 Dec 2020 12:12:11 GMT
location: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
cf-ray: 60284fa97d8d082c-CDG
link: <https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI>; rel="canonical"
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 070d101de90000082c1bad0000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
x-robots-tag: none
server: cloudflare

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 376ms
179ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:07 GMT
Server: nginx
ETag: W/"5fd9f3f7-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:12 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
13 KB 203ms
58ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 23b2ce7e8ca6a498b504276ba50bae356859abbda43f9682d1d7e516fe904a16

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: rOWohK8rqb1HwoXELh_XgjM3_3D0NX61
content-encoding: gzip
etag: "f274bce7ee0ace5a9f526ffc201d8d96"
age: 1328
x-cache: Hit from cloudfront
content-length: 13314
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 15 Dec 2020 23:44:30 GMT
server: AmazonS3
date: Wed, 16 Dec 2020 11:50:56 GMT
content-type: application/javascript
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
x-amz-cf-id: ugCgA6_INNWIvi5nCyidq_PUJ051mfBfzWzqSMpohSigS84qSypj0g==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 23 KB
3 KB 121ms
35ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63d79a5b76b4bef8bb9cd4b451bb60b4a2d277e3b4664d26eac47cb8527fbe02

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 584
cf-request-id: 070d1023da00001fd2f8876000000001
last-modified: Tue, 24 Nov 2020 20:59:06 GMT
server: cloudflare
etag: W/"5a6e-5b4e094d59cb4-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FMNm1MOAzXbfUF5Y6%2FO8kYByhLVUP4fjpH%2BlHrqCYcsOJDUFAvBo2rxSZcKyqaZ0emakXrTAOiY1YSW5vX14OVTKE3AuSZf6i3WB8o2EkIOtVV%2FgQ9dxyLFTWFpvsSLi"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 60284fb2ef1c1fd2-AMS
expires: Wed, 16 Dec 2020 12:06:43 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 54 KB
19 KB 40ms
16ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

678c16283762d2d1a12c9b055cf3e4333ca3c4c6638a95741f1130084882756f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "725 / 755 of 1000 / last-modified: 1608034737"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 18850
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:12 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 256ms
170ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 070d1023d900001fd218108000000001
last-modified: Tue, 06 Oct 2020 19:53:29 GMT
server: cloudflare
etag: W/"4c426-5b105f3f297c7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rtQJJ6f8wrV8hosyJBnlGXwJTDEKYhlff2NFw3jRU2RjkSt149NFaSHATqG14gZQGtQQI1Guses6TDNo8WWAvSQ3XLyk3PSCeqTZcsZLFD3Kf3%2F4qEl0h%2B5Tqd6JJ%2FkK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 60284fb2ef2d1fd2-AMS
expires: Wed, 16 Dec 2020 12:16:55 GMT

GET
H2 200 uspcmp.js Show response
qd.admetricspro.com/js/threatpost/ 148 KB
55 KB 273ms
188ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 070d1023d900001fd2ec072000000001
last-modified: Sat, 08 Aug 2020 22:40:07 GMT
server: cloudflare
etag: W/"24e50-5ac65673cef1c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EQWgbBRM4g2oJxQZnpR8kQ2H5YH%2F3EIeOABCb9vawGj8dON6OAX0zTWQwvheYLdoPFuofvpE23W6b7DiyorLjs88BpUthePGrg%2BzNGAni%2F2g35gzMrB8L%2Be%2BTzvMTGw3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 60284fb2ef2f1fd2-AMS
expires: Wed, 16 Dec 2020 12:16:55 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
433 B 260ms
187ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 070d1023d900001fd2b7941000000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6qODXc2hpVe6UYGBwV2eVy04dfqtD1G6MoIlH1FgOPYxPU2VEhBnGghuHzfYa5r2al9lv7KhUjYjElrHdZibzozQC5VY286XiGWc7DXDn2oXvfpdq5xxJaAiXU5QHOjD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 60284fb2ef301fd2-AMS
expires: Wed, 16 Dec 2020 12:16:55 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 399 KB
113 KB 272ms
200ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 070d1023da00001fd2e83af000000001
last-modified: Fri, 02 Oct 2020 04:32:28 GMT
server: cloudflare
etag: W/"63c0e-5b0a89ec6a525-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LMymhJKEahNPN%2FHCVGQqM6ZBxBYam3XZqk6S%2FnZ4gMUhAenKIKoQ7%2Bmhd1gXR%2F9A9uoy5FPpB3nfSdQPY5zzdbRTR6HqIkPRgwzX9odeTQgvbUJJteJ5RNwk2q3hQ%2FwR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 60284fb2ef311fd2-AMS
expires: Wed, 16 Dec 2020 12:16:55 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 28 KB
8 KB 228ms
155ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 070d1023da00001fd2083f2000000001
last-modified: Fri, 09 Oct 2020 03:25:52 GMT
server: cloudflare
etag: W/"6e56-5b1348179d4a3-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=85swSr4AoGDRgT9KrJPiqPz9l76zXmaMAyTKCtWBE8k5ExIFmGEv2woUvDL8XY44E2uOp26vqg6vGyr8dWS6dKdYJMXinzhTg05sUVeaUAi2I3pC5Hua32JlSUEWDj2t"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 60284fb2ef321fd2-AMS
expires: Wed, 16 Dec 2020 12:16:55 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 351ms
279ms Stylesheet
text/css 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=d0ca8bcc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: gzip
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
content-length: 18335
x-cache-hit: HIT
last-modified: Wed, 16 Dec 2020 11:48:00 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: Eo7At8CSmSNbyiWYCf0c7rXVI-j89bfYv64EYG3iL70S5pnws-UaPw==
expires: Thu, 17 Dec 2020 11:49:26 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 386ms
178ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:12 GMT
Content-Encoding: gzip
Last-Modified: Fri, 30 Oct 2020 20:48:12 GMT
Server: nginx
ETag: W/"5f9c7c0c-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:12 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 443ms
371ms Script
application/x-javascript 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=d0ca8bcc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: gzip
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
content-length: 56256
x-cache-hit: HIT
last-modified: Wed, 16 Dec 2020 11:48:02 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: jqL6g6xHamFrnVQWvkaPfVU_lKYS_xtQ8j7SiD4PMXM7-3yTq3u_fg==
expires: Thu, 17 Dec 2020 11:49:28 GMT

GET
H2 200 covid19-healthcare.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/12/02155123/ 48 KB
49 KB 172ms
11ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/12/02155123/covid19-healthcare.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 540574a1fd48565e8f1f9832d7e32b6894a24e733b7ecc59cf0985c98cbf7f99

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 07:42:00 GMT
via: 1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Wed, 02 Dec 2020 20:51:25 GMT
server: AmazonS3
age: 102614
etag: "76bb7f3e3efe7b224b3cf6784025da5b"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA53-C1
accept-ranges: bytes
content-length: 49442
x-amz-cf-id: TYpklGB5RlQscCy_gJRWURXaWff8U1cW635P9M5ft9E5-WZJNu_c6Q==
expires: Thu, 02 Dec 2021 20:51:23 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
747 B 17ms
17ms Script
text/javascript 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

39eba381af6c8ff003ce267900866864e5a90752fe7d343d32b0ae20a21fa2b7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 1; mode=block
expires: Wed, 16 Dec 2020 12:12:13 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 288ms
282ms Script
application/x-javascript 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=d0ca8bcc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
content-length: 926
x-cache-hit: HIT
last-modified: Wed, 16 Dec 2020 11:48:00 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 8XbA2uTq2jlreCAO-RFJWIqhdDcnfMSfbeD83TUf8lr7lWI6S3V8qg==
expires: Thu, 17 Dec 2020 11:49:27 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 727ms
101ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:00 GMT
Server: nginx
ETag: W/"5fd9f3f0-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 289ms
265ms Script
application/x-javascript 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=d0ca8bcc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
content-length: 2685
x-cache-hit: HIT
last-modified: Wed, 16 Dec 2020 11:48:06 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: lnhWSqIcjBUGnnGDcBWmC26evaCqpFww9BhMu9ki-CMCpIckrBUYUw==
expires: Thu, 17 Dec 2020 11:49:28 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 323ms
291ms Script
application/x-javascript 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=d0ca8bcc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
content-length: 1747
x-cache-hit: HIT
last-modified: Wed, 16 Dec 2020 11:47:59 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: fo7WiEW0uVyUdv1lbHXGN4WoYmUPg39vLWqsZeLVtl5erM8mV5_Ymg==
expires: Thu, 17 Dec 2020 11:49:28 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 852 B
704 B 47ms
25ms Script
text/javascript 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.3

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

dd84e4f7d8c6e9538619f41cb37c903f67ce16f68f59e7fe19af8176ced12645

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 557
x-xss-protection: 1; mode=block
expires: Wed, 16 Dec 2020 12:12:13 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 400ms
371ms Script
application/x-javascript 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=d0ca8bcc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront
content-length: 973
x-cache-hit: HIT
last-modified: Fri, 30 Oct 2020 20:48:12 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ANKPFBJTsHO_UqM_soinlXiE_1s00yQ4ebjPMkW1TsHmP10OWsVYpQ==
expires: Thu, 17 Dec 2020 11:49:28 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 136ms
97ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 03 Nov 2020 02:02:02 GMT
content-encoding: gzip
age: 3751812
x-cache: Hit from cloudfront
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: LJDKiW8c4X1b7h0nYEt3OUUBK09TFXai6xnO5JVNYVIXS-okdZQu3A==

GET
H2 200 bl-994939b-b2d9a8b7.js Show response
tagan.adlightning.com/math-aids-threatpost/ 83 KB
25 KB 140ms
96ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 666652b748f9a7861810bb52c2cbf5cf657c33e6ec53afd028455f6f6b7d3124

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 23:46:36 GMT
content-encoding: gzip
age: 44738
x-cache: Hit from cloudfront
content-length: 25087
x-amz-meta-git_commit: 994939b
last-modified: Tue, 15 Dec 2020 23:44:11 GMT
server: AmazonS3
etag: "6aafd7df6c9cdfbf75b4fe30ef0df49f"
x-amz-version-id: PAffgHqhfrCA1Cn3da0x_KJQGmBePJ.s
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: JCssa4sNZCZVlUK1Vy-mz-JTWaq8s4HJ4ZezTEo5ELZMP67xQeVsMQ==

GET
H2 200 pubads_impl_2020120801.js Show response
securepubads.g.doubleclick.net/gpt/ 274 KB
97 KB 39ms
38ms Script
text/javascript 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

sffe /

Resource Hash

5f02981bfcab6807a15ddfea1babc7cee05cd0f1f59abe712928de44fb6c1f0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 16 Dec 2020 12:12:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Dec 2020 09:42:29 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98829
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:12 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 286 KB
30 KB 188ms
156ms XHR
application/json 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Tue, 06 Oct 2020 19:31:27 GMT
server: cloudflare
etag: W/"4773b-5b105a5302c6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SCRt10RLv1mAVRnTIY5hbP9eyQLh%2B5NEo2yFeXWwK9J35jJdBJwltpYno0N4C4sSee1iM8lKlnhh0KyYAPVGzMH4327bl0yh8UW%2Bt9C3SWnF3KOs%2BeQNm3SbqzYiccxL"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 60284fb6287fd8b1-AMS
cf-request-id: 070d1025d40000d8b1a61fb000000001
expires: Wed, 16 Dec 2020 12:22:13 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 116 KB
30 KB 227ms
67ms Script
application/javascript 65.9.86.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: dde5dcb02f349d5cd1f36d6afe709ddfd5713b27129dbae727f456cde6582883

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: dMDl4v7Re.7jmw9HDy.5O8xRCx.Enz0f
content-encoding: gzip
server: Server
age: 884
etag: 089c185b065ebe3e9c21625b16dea242
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 317b3418459e7cb903a13afaecea9340.cloudfront.net (CloudFront)
cache-control: public, max-age=900
date: Wed, 16 Dec 2020 11:57:29 GMT
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: SzWDsrOota3AfpTuS1z-Hdi-elqutb53uFCLphwJPhnCgDdWp6QWkw==

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/84835/ Frame 98AA
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/84835/connatix.player.dc.js

921 KB
228 KB

130ms
69ms

Script
application/javascript

151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/84835/connatix.player.dc.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 14f2cbb5db9c090f3869165c6d45d832483297273c75940921d7a056c0dabff2

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
via: 1.1 varnish, 1.1 varnish
age: 13380
x-cache: HIT, HIT
content-encoding: gzip
content-length: 233411
x-served-by: cache-dca17771-DCA, cache-cdg20760-CDG
last-modified: Tue, 15 Dec 2020 21:41:38 GMT
x-timer: S1608120734.520790,VS0,VE0
etag: "b44aad7c24326ac33d4ec1c229368fd0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 9

Redirect headers

date: Wed, 16 Dec 2020 12:12:13 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-cdg20760-CDG
x-cache: HIT
location: https://cds.connatix.com/p/84835/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1608120733.369471,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 494ms
151ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1082093341&back=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 12:12:13 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 157 KB
50 KB 48ms
4ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c90bbd20e641ee6df4970ba4c2baaa66980c50966573ea66cfbca91584d9cc69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50780
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:13 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 713ms
106ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:07 GMT
Server: nginx
ETag: W/"5fd9f3f7-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 744ms
101ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:07 GMT
Server: nginx
ETag: W/"5fd9f3f7-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H2 200 pPyTJO5c4_U
www.youtube.com/embed/ Frame D2D7 0
0 140ms
106ms Document
text/html 2a00:1450:4001:818::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/pPyTJO5c4_U?feature=oembed

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/pPyTJO5c4_U?feature=oembed
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-type: text/html; charset=utf-8
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-length: 21093
expires: Tue, 27 Apr 1971 19:44:06 GMT
x-content-type-options: nosniff
date: Wed, 16 Dec 2020 12:12:13 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=2PjkqKSX7Ac; path=/; domain=.youtube.com; secure; expires=Mon, 14-Jun-2021 12:12:13 GMT; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Wed, 16-Dec-2020 12:42:13 GMT YSC=jEHUrFp5dxc; path=/; domain=.youtube.com; secure; httponly; samesite=None VISITOR_INFO1_LIVE=2PjkqKSX7Ac; path=/; domain=.youtube.com; secure; expires=Mon, 14-Jun-2021 12:12:13 GMT; httponly; samesite=None
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 916ms
237ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:07 GMT
Server: nginx
ETag: "5fd9f3f7-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 184ms
100ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:13 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: "5fd9f3f1-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Thu, 16 Dec 2021 12:12:13 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 250ms
104ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:13 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: "5fd9f3f1-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Thu, 16 Dec 2021 12:12:13 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 299ms
99ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:13 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: "5fd9f3f1-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Thu, 16 Dec 2021 12:12:13 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 359ms
100ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:13 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: "5fd9f3f1-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Thu, 16 Dec 2021 12:12:13 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 374ms
102ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:13 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: "5fd9f3f1-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Thu, 16 Dec 2021 12:12:13 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 449ms
178ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:13 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:07 GMT
Server: nginx
ETag: "5fd9f3f7-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Thu, 16 Dec 2021 12:12:13 GMT

GET
H2 200 0.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/ 10 KB
11 KB 13ms
11ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/0.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 19 Sep 2020 01:31:54 GMT
via: 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Mon, 20 Aug 2018 15:57:19 GMT
server: AmazonS3
age: 7641620
etag: "756a0525b47f4557fdfec408731afd91"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 10662
x-amz-cf-id: 3LdjvvR4Yau804B8elWYekGLBQ_CJuU0RM6KjaVxJMFaInU1ma_p8Q==
expires: Tue, 20 Aug 2019 15:57:18 GMT

GET
H2 200 health_ebook_promo_art.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/12/10164612/ 15 KB
15 KB 20ms
19ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/12/10164612/health_ebook_promo_art.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 41db58474cfc6b16f6dba3f773163a7ecd2ef561269f0f248335cb43bc4848c8

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Dec 2020 22:05:52 GMT
via: 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Dec 2020 21:46:14 GMT
server: AmazonS3
age: 482782
etag: "2dcb2bd3fab2dc13879ce0e778867bb7"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA53-C1
accept-ranges: bytes
content-length: 14988
x-amz-cf-id: 2dzTm2LOQcg2j9M4KdBg3FomAM5zC_40Vlc-hSxByAPkYvvWdv5o5A==
expires: Fri, 10 Dec 2021 21:46:12 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/NTa-8tBgsAw62CYTJPliVdrV/ 335 KB
131 KB 65ms
11ms Script
text/javascript 2a00:1450:4001:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/NTa-8tBgsAw62CYTJPliVdrV/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f792fc4642c5120f96b4f11b6899eb9e8c6b286e5f6dc8be0015ff7b46223bca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 417
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133685
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 03:08:20 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:05:17 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 376 B
1 KB 176ms
55ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

17c510338e5643237d26026172aec9af3088ab7444f183bb309e9ceec8557af8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.41:80
AN-X-Request-Uuid: ee75e350-b8e4-41ec-a31b-c9a88ddfff80
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 376
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 96 B
759 B 356ms
230ms XHR
application/json 216.52.2.48
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 3477ff569941363c5b777f2fb7f264a60b975bfba13297258a4b4b8413f0f2a7

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 100

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 355ms
210ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&tk_flint=pbjs_lite_v4.10.0&x_source.tid=11cd809d-2725-440b-bc71-f5093cf93e35&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9945659583082922
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: fc3de78f8df37d9c0715cdc8fa2de817666f3774bc1a095de5259b86e8a23d2b

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 351ms
204ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&tk_flint=pbjs_lite_v4.10.0&x_source.tid=f519d519-9c9f-4b60-9032-368ec12e9205&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8311188949820607
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 8c3e40d93030ddeac2c5a16a0d1de5e8573c7f018e421582354930fc36846fab

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 354ms
208ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&tk_flint=pbjs_lite_v4.10.0&x_source.tid=38d2eeba-cb05-44d2-a699-e17d978f5396&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9118742659619008
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: d24af29ede48d566c6450a21f6cbb2ec8a7e2a50213d8b28514c38080c7eafee

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 353ms
209ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&tk_flint=pbjs_lite_v4.10.0&x_source.tid=38d2eeba-cb05-44d2-a699-e17d978f5396&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7895564993757751
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 1af71dc28e3d3ca8510776da51cd07996148df0f58601a0bd28d5583b6801a41

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 204
No Content mvo Show response
tag.1rx.io/rmp/216477/0/ 0
271 B 205ms
56ms XHR
text/plain 213.19.147.210
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/216477/0/mvo?z=1r&hbv=4.10,2.1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
Cache-Control: private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Server: Tengine
Connection: keep-alive

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=62a8b52517cbf9c;misc=1608120734082; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ 48 B
266 B 239ms
131ms XHR
application/json 2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62a8b52517cbf9c;misc=1608120734082;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 3fa95dd8157b6539ad198e5a2563cbae65c444b13634acf8879d1330d5cb35d2

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
server: Adtech Adserver
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=635899d674193bd;misc=1608120734082; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ 48 B
82 B 493ms
391ms XHR
application/json 2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=635899d674193bd;misc=1608120734082;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 7f9f3bccb662840153703ccd7651000c02fe3825cd28ddac5b00f93f5fef26bd

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
server: Adtech Adserver
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
x-adtech-meta: {"Debug": {"IP": "0.0.0.0", "Selector": "pri-select030c.us-east-1.prod.adtech.aolcloud.net", "UserId": "5FD9F6C06E6517442D9135D5E0000000"}}
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=64d480884958065;misc=1608120734082; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ 48 B
206 B 298ms
203ms XHR
application/json 2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=64d480884958065;misc=1608120734082;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 70cf9dde06143684f8787341cd08282b68b3d5eedd4588b1d6f04b3de5074b7e

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
server: Adtech Adserver
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
x-adtech-meta: {"Debug": {"IP": "0.0.0.0", "Selector": "pri-select030c.us-east-1.prod.adtech.aolcloud.net", "UserId": "5FD9F6C06E6517442D9135D5E0000000"}}
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=65f414d6f01b9de;misc=1608120734083; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ 48 B
81 B 245ms
151ms XHR
application/json 2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=65f414d6f01b9de;misc=1608120734083;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 5087676d610ad3975573f4db9dd354a9f33e77f42f9bea48ce90ee07b242d019

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
server: Adtech Adserver
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=660b93ea560f493;misc=1608120734083; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ 48 B
81 B 253ms
159ms XHR
application/json 2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=660b93ea560f493;misc=1608120734083;
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 3e53947da478f53ccea775eb5354a0b5d39e576c91d0b99975ff6c7408ecb1d8

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
server: Adtech Adserver
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 655 B
755 B 511ms
161ms XHR
application/json 136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: afc70f0ed7e054454fa639e9bdd7f5de52543f36fffc3421dddcf12403334821

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 16 Dec 2020 12:12:13 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 53
content-length: 327

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
373 B 332ms
250ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22307ca519a91265d%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2231bf5ed12be038b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2232eccf5646d5a48%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%223344a49f2cbfa05%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2231bf5ed12be038b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2231bf5ed12be038b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2232eccf5646d5a48%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%223344a49f2cbfa05%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5cd516aa5e44d31a803ee416ba5fd13e5e33b66bc6c909a05875cbd622a75f44

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[FR], RC:[IDF], CN:[EU], CIP:[82.102.18.114], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
x-cs-client-geo: 28
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 28
expires: Wed, 16 Dec 2020 12:12:14 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 173 B
560 B 371ms
234ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=11cd809d-2725-440b-bc71-f5093cf93e35%2C11cd809d-2725-440b-bc71-f5093cf93e35%2Cf519d519-9c9f-4b60-9032-368ec12e9205%2C38d2eeba-cb05-44d2-a699-e17d978f5396%2C38d2eeba-cb05-44d2-a699-e17d978f5396&nocache=1608120734095&gdpr=0&x_gdpr_f=1&pubcid=170fb9bc-bd7e-4793-9f58-0d2f65adb835&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash: 2f151eb5e281a98c051cb30101eb1beab16d67b2b96733d1f97c03aa669b96f9

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
content-encoding: gzip
server: OXGW/16.199.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 309ms
124ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
date: Wed, 16 Dec 2020 12:12:14 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
475 B 178ms
117ms XHR
application/json 18.196.13.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.13.179 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-13-179.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:14 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 376 B
1 KB 135ms
61ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

7d0a0574ca4779d98a9bf59afb6136251b0d63c43f5536a239c04b4c2f6f7f45

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:14 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.60:80
AN-X-Request-Uuid: 5cfcd085-1077-4b6b-8699-281e8c1ac66c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 376
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 414ms
101ms XHR
application/json 167.172.1.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.172.1.14 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
date: Wed, 16 Dec 2020 12:12:14 GMT
access-control-allow-credentials: true
content-length: 16
vary: Origin
content-type: application/json

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 388ms
101ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: W/"5fd9f3f1-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 389ms
103ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: W/"5fd9f3f1-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:14 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 5 KB
3 KB 338ms
119ms XHR
application/json 34.255.243.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=2285
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.243.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 3da0404e916206ff343d9b0c419c66e83f5d0821504887d48f3a176c05b2a99e

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 16 Dec 2020 12:12:14 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

GET
H2 200 networks-1-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/12/10162309/ 2 KB
3 KB 56ms
29ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/12/10162309/networks-1-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a5df491d38bad7be4712ad0e6c636de9212027d2b0fbb433eebda0c2f3182ca2

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 10 Dec 2020 21:24:40 GMT
via: 1.1 c51e3be89c14e3f859ea898f7e36eced.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Dec 2020 21:23:13 GMT
server: AmazonS3
age: 485255
etag: "c2a8bf44ca541251542cd1acb2eac818"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA53-C1
accept-ranges: bytes
content-length: 2506
x-amz-cf-id: PwVlII_t_DGAxanr35f8qVe9MnXHjBxDd903nH_PX03iTEwLQ6GcKg==
expires: Fri, 10 Dec 2021 21:23:12 GMT

GET
H2 200 sensors-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/12/04163111/ 2 KB
2 KB 43ms
17ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/12/04163111/sensors-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9101fe1d604c3876d71e0a5f60f2d368a597e4d477c6462b5ee49647eb790c5b

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Dec 2020 21:35:14 GMT
via: 1.1 e7b88cadf742e342f39f17392af35c4f.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Fri, 04 Dec 2020 21:31:16 GMT
server: AmazonS3
age: 1003021
etag: "c67cb7a507d1d8d47aa8bff1488b279e"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA53-C1
accept-ranges: bytes
content-length: 2045
x-amz-cf-id: GSwLfuHlC5qpmbfhttqiJSHjCFB_Ej57obpuZtZYec0hUibi5qds8g==
expires: Sat, 04 Dec 2021 21:31:15 GMT

GET
H2 200 mobile-worker-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/12/03101738/ 2 KB
3 KB 38ms
13ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/12/03101738/mobile-worker-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0ced2f69c8187c7d57855114c9539b24cde31b0454d1ceffe7f3f7131cc16523

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Dec 2020 15:19:02 GMT
via: 1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Thu, 03 Dec 2020 15:17:42 GMT
server: AmazonS3
age: 1111993
etag: "0c89b4d5362a54c43ed9e0fb4f21b543"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 2324
x-amz-cf-id: TY6zz83GYliT_tbCfz9NZZ4gxy9DlFedhV0m-UInU9njMxv8x6FShw==
expires: Fri, 03 Dec 2021 15:17:41 GMT

GET
H2 200 Robot2-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/11/25105002/ 2 KB
2 KB 40ms
24ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/11/25105002/Robot2-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 09ed42fd78450e67d460350fa19015c2df2692b002941add1bef52e5b8af8b62

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 27 Nov 2020 14:00:47 GMT
via: 1.1 2fcedcc055e24d7ac99fbc19ed8fc8ec.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Wed, 25 Nov 2020 15:50:19 GMT
server: AmazonS3
age: 1635088
etag: "d1a8a888cf08236c481437902b69011d"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA53-C1
accept-ranges: bytes
content-length: 1816
x-amz-cf-id: loSqz9AWX-KgIMPrEUN6xBwZ3BkgkwYQjvDmvnAZGC89Q-3s1rIjwA==
expires: Thu, 25 Nov 2021 15:50:16 GMT

GET
H2 200 Work-From-Home-WFH-Cat-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/06/23144936/ 2 KB
3 KB 45ms
30ms Image
image/jpeg 2600:9000:214f:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/06/23144936/Work-From-Home-WFH-Cat-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d88242d6bd1a8281c9f6162bfd0a9e9834021019cf692e20bf60b880d0f62b49

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 25 Nov 2020 15:26:25 GMT
via: 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront), 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 18:49:40 GMT
server: AmazonS3
age: 1802749
etag: "3af4374cbdf88f0c93d0b55737484cba"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA53-C1
accept-ranges: bytes
content-length: 2205
x-amz-cf-id: fdvMPa7q_I7Twg-inU36yxrNYqYfYQytOR4RjYoYHBBJrvSmYXykbQ==
expires: Wed, 23 Jun 2021 18:49:39 GMT

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 297ms
100ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: W/"5fd9f3f1-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 297ms
100ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1608119287
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 16 Dec 2020 12:12:14 GMT
Last-Modified: Wed, 16 Dec 2020 11:48:01 GMT
Server: nginx
ETag: "5fd9f3f1-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Wed, 23 Dec 2020 12:12:14 GMT

GET
H2 200 connatix.player.css
cds.connatix.com/p/84835/ 53 KB
9 KB 26ms
25ms Stylesheet
text/css 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/84835/connatix.player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1d5ce6abfc56177b773caf44c619827632b66db724318425c0bcbe27066ab06b

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:14 GMT
via: 1.1 varnish, 1.1 varnish
age: 13381
x-cache: HIT, HIT
content-encoding: gzip
content-length: 8739
x-served-by: cache-dca17755-DCA, cache-cdg20760-CDG
last-modified: Tue, 15 Dec 2020 21:41:38 GMT
x-timer: S1608120735.965431,VS0,VE0
etag: "42936fef42768e7907ea66cb1e2192a2"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 340

GET
H/1.1 200
OK v1 Show response
geo.ipify.org/api/ 382 B
1 KB 655ms
316ms XHR
application/json 64.140.160.2
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL

https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),

Reverse DNS

threatintelligenceplatform.com

Software

nginx /

Resource Hash

4b843501135b1da9cf37b6ac228b459b11996d7a269adeb999ca4860dbe65b7f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 12:12:15 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
565 B 295ms
295ms Image
image/svg+xml 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=d0ca8bcc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=d0ca8bcc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Wed, 16 Dec 2020 12:12:15 GMT
content-encoding: gzip
last-modified: Wed, 16 Dec 2020 11:48:01 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
etag: W/"5fd9f3f1-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cache-control: max-age=604800, public
x-amz-cf-id: gxqq3NqzRnhyIjIDG5hGcWtIBqdDiNGAbXg_4lLUW1lwgWRDMfZtpQ==
expires: Wed, 23 Dec 2020 12:12:15 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 322ms
302ms Font
font/woff2 2600:9000:2057:8400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=d0ca8bcc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:8400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=d0ca8bcc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Wed, 16 Dec 2020 12:12:15 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
last-modified: Wed, 16 Dec 2020 11:48:02 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
etag: "5fd9f3f2-12d68"
x-cache: Miss from cloudfront
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-length: 77160
x-amz-cf-id: wAe3yJbysSDKb14FTPnh-XMJKaSo30k6_v5VCPDBCAR2dK46hDodpQ==
expires: Thu, 16 Dec 2021 12:12:15 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
370 B 72ms
72ms XHR
text/javascript 65.9.86.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&pid=AthqObEFtL0c0&cb=0&ws=1600x1200&v=7.58.01&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:15 GMT
via: 1.1 317b3418459e7cb903a13afaecea9340.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: AMS1-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: cV5H5kjqqsCTMIV4ROrWGcMAf8IJEs65NmHBVFXEUA2Mi3BeXyjMaA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 141ms
60ms XHR
application/javascript 65.9.86.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.86.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
etag: "a4d296427fc806b21335359e398c025c"
age: 56878
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Sat, 05 Dec 2020 02:12:39 GMT
server: AmazonS3
date: Tue, 15 Dec 2020 20:24:18 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 cc03ea6a31b592e93e84115778cdc495.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: gtfSMElf4kbSFEu4EtrIv14-kZ3KouUPKsliHOGkznH-iYbw4KRdZQ==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 1300
date: Wed, 16 Dec 2020 11:50:35 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Wed, 16 Dec 2020 13:50:35 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 41ms
8ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 437afd9de21717c919be3f40f686b33170f2447dc03ded0fc00ac0cc41839854

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:15 GMT
content-encoding: gzip
etag: "8q1rat7Mm9i+FVcOidF8/g=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 23 Dec 2020 12:12:15 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 110ms
39ms Script
application/javascript 199.232.52.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.52.157 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:15 GMT
via: 1.1 varnish
last-modified: Fri, 04 Dec 2020 00:21:46 GMT
age: 52765
etag: "cbc512946c8abb461c6215ed5b454e5f+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1957
x-timer: S1608120735.229772,VS0,VE0
x-served-by: cache-man4139-MAN

GET
H2 400 / Show response
graph.facebook.com/ 202 B
584 B 61ms
39ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e073a12d691638f65d1db0f997ddd70bb2c8666198eee42f9c8c33d7a449f602

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1003109802
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 151
pragma: no-cache
x-fb-debug: IbpXi3ac1RO7PiO8LYrQnWBJ5Yy8xy5R8W1jH80xi5rY0+kExTIrjUOvcNS6ibwH2t5S/DCag5fUigREmEL8tg==
x-fb-trace-id: HYn2Uti49gQ
date: Wed, 16 Dec 2020 12:12:15 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AgNlTwkkyRtwCdjJmF9-gWX
cache-control: no-store
facebook-api-version: v3.2
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 115ms
115ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F&format=jsonp&callback=jQuery112405214836890377574_1608120733325&_=1608120733326
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 239ms
149ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:15 GMT
via: 1.1 varnish
x-content-type-options: nosniff
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame B1DB 0
0 28ms
26ms Document
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&theme=standard&size=normal&cb=66rxs4i387s0

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-15ZqeFuIrFg4YaBWEv/QZg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&theme=standard&size=normal&cb=66rxs4i387s0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 16 Dec 2020 12:12:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-15ZqeFuIrFg4YaBWEv/QZg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10841
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame 98AA 7 KB
3 KB 514ms
165ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: 494749353b8e05ac746d7d6cfba920dab49572fa0964c032c86a27163acfed72

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:15 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
169 B 24ms
24ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
169 B 20ms
20ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 125 KB
26 KB 417ms
416ms XHR
text/plain 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2437964433651654&correlator=4306847664026385&output=ldjh&impl=fifs&eid=21068426%2C21068602%2C21068772%2C21069144%2C21068812%2C21068864&vrg=2020120801&ptt=17&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201216&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D67487156749de6e%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D67487156749de6e%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fransomware-ip-theft-top-covid-19-healthcare-security-scares%252F162247%252F%26urlquery%3Dgoogfc%26contentid%3D162247%26category%3Dcritical-infrastructure%26contenttags%3Dcoronavirus%252Ccovid-19%252Ccovid-19-supply-chain%252Chealthcare%252Chealthcare-security%252Chospital-ransomware%252Chospitals%252Ciot-medical-devices%252Cip-theft%252Cpandemic%252Cransomware-attack%252Cuvm-health-network&cookie_enabled=1&bc=31&abxe=1&lmt=1608120735&dt=1608120735365&dlt=1608120732503&idt=540&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1568%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=917817449.1608120735&ga_sid=1608120735&ga_hid=784099628&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

75b04f3f04c19903fc665d411ce93bc7282bbba6acb47e7af3281c75e3d967a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26602
x-xss-protection: 0
google-lineitem-id: -1,-1,5192770279,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,138290162637,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
ad313c47c975dc9b795684fdc862df28.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 30ms
15ms Other
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ad313c47c975dc9b795684fdc862df28.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 7ms
6ms Other
text/html 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame A5E8 0
0 35ms
33ms Document
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&theme=light&size=normal&cb=88e9wr5sxfkk

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qlovqEVW58ZZJJDHoUiKIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&theme=light&size=normal&cb=88e9wr5sxfkk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 16 Dec 2020 12:12:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-qlovqEVW58ZZJJDHoUiKIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 11151
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
65 B 15ms
15ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=784099628&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ul=en-us&de=UTF-8&dt=Ransomware%20and%20IP%20Theft%3A%20Top%20COVID-19%20Healthcare%20Security%20Scares%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEABAAAAAC~&jid=763907297&gjid=2127258441&cid=917817449.1608120735&tid=UA-35676203-21&_gid=2014308241.1608120735&_r=1&gtm=2wgbu0PM29HLF&z=376724478

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
63 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j87&aip=1&a=784099628&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ul=en-us&de=UTF-8&dt=Ransomware%20and%20IP%20Theft%3A%20Top%20COVID-19%20Healthcare%20Security%20Scares%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YAjAAEABAAAAAC~&jid=&gjid=&cid=917817449.1608120735&tid=UA-35676203-21&_gid=2014308241.1608120735&gtm=2wgbu0PM29HLF&z=1669277709

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 15 Dec 2020 16:19:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 71573
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
356 B 463ms
431ms Script
application/x-javascript 2600:9000:2127:c000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:c000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:09:01 GMT
via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 196
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
cache-control: max-age=300
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: YdHLbC4zkDBJPe89C8jfxMPAfSuh7RWltRlgBAdjTIzs2J4fuPv-Ig==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-35676203-21&cid=917817449.1608120735&jid=763907297&gjid=2127258441&_gid=2014308241.1608120735&_u=YAhAAEAAAAAAAC~&z=1908914756

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 16 Dec 2020 12:12:15 GMT
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 227ms
148ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 107
pragma: no-cache
last-modified: Wed, 16 Dec 2020 12:12:15 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f7b5cebdff2133ebae97fe0ffcf50b83
x-transaction: 001fc44b002c4cca
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
448 B 21ms
19ms Image
image/gif 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=917817449.1608120735&jid=763907297&_u=YAhAAEAAAAAAAC~&z=1582673058

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 27ms
26ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=917817449.1608120735&jid=763907297&_u=YAhAAEAAAAAAAC~&z=1582673058

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 8448 0
0 22ms
21ms Document
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=h9geuuk351na

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AS6Xw6WRHNl0gFHMhaaL5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=h9geuuk351na
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 16 Dec 2020 12:12:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-AS6Xw6WRHNl0gFHMhaaL5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1122
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 0E3F 0
0 32ms
31ms Document
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=fz1jk9tityxi

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-61wWPHsfphUAIPtHYUbKjQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=NTa-8tBgsAw62CYTJPliVdrV&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=fz1jk9tityxi
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 16 Dec 2020 12:12:16 GMT
content-security-policy: script-src 'report-sample' 'nonce-61wWPHsfphUAIPtHYUbKjQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1121
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-994939b-b2d9a8b7.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 0769 83 KB
25 KB 62ms
57ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 666652b748f9a7861810bb52c2cbf5cf657c33e6ec53afd028455f6f6b7d3124

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 23:46:36 GMT
content-encoding: gzip
age: 44740
x-cache: Hit from cloudfront
content-length: 25087
x-amz-meta-git_commit: 994939b
last-modified: Tue, 15 Dec 2020 23:44:11 GMT
server: AmazonS3
etag: "6aafd7df6c9cdfbf75b4fe30ef0df49f"
x-amz-version-id: PAffgHqhfrCA1Cn3da0x_KJQGmBePJ.s
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: QOPFIXnfQAd8fjfrY7NGoMBIgCbTBdVvEhAuAdVG-4gZcbaTU0Ko_Q==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 0769 61 KB
21 KB 72ms
68ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 03 Nov 2020 02:02:02 GMT
content-encoding: gzip
age: 3751814
x-cache: Hit from cloudfront
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: SD5e2bDuBf_ZGpTKfc3zQ3BHmJnD4AqFekNgy35xR8HPWbGc6hANSw==

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 445ms
112ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:16 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

GET
H2 200 3_media.bin Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 232 B
468 B 83ms
22ms XHR
application/octet-stream 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:16 GMT
content-encoding: gzip
last-modified: Thu, 17 Sep 2020 01:42:41 GMT
age: 722105
etag: "796c77896c9738780ae744fd3eb73483"
x-served-by: cache-bwi5145-BWI, cache-cdg20738-CDG
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120736.497637,VS0,VE1
content-length: 204
x-cache-hits: 1, 1

GET
H2 200 1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 6 KB
7 KB 39ms
24ms Image
image/png 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:16 GMT
content-encoding: gzip
age: 1052015
x-cache: HIT, HIT
fastly-io-info: ifsz=8114 idim=288x42 ifmt=png ofsz=6487 odim=288x42 ofmt=png
fastly-stats: io=1
content-length: 6510
x-served-by: cache-dca17739-DCA, cache-cdg20760-CDG
access-control-allow-origin: *
x-timer: S1608120736.494249,VS0,VE1
etag: "CDlq0wWU2N6Hha9Y1OkqKS7K/JyWAUvXYL5GlZ2se8g"
x-amz-request-id: 20239F3552E1CC0E
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1, 1

GET
H2 200 bl-994939b-b2d9a8b7.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame AD3F 83 KB
25 KB 56ms
55ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 666652b748f9a7861810bb52c2cbf5cf657c33e6ec53afd028455f6f6b7d3124

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 23:46:36 GMT
content-encoding: gzip
age: 44741
x-cache: Hit from cloudfront
content-length: 25087
x-amz-meta-git_commit: 994939b
last-modified: Tue, 15 Dec 2020 23:44:11 GMT
server: AmazonS3
etag: "6aafd7df6c9cdfbf75b4fe30ef0df49f"
x-amz-version-id: PAffgHqhfrCA1Cn3da0x_KJQGmBePJ.s
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: vnOZulRIKzhgtFlGO3oGaE0tG6Bq8zw-5ibLZz_R1qjLnJR4no_Aiw==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame AD3F 61 KB
21 KB 64ms
63ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 03 Nov 2020 02:02:02 GMT
content-encoding: gzip
age: 3751815
x-cache: Hit from cloudfront
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: -f_wMe8NQLUbgLUISFLAOIk7ml5tVTBJbK4X_NZrEmThe-ziGzyEqQ==

GET
H2 200 bl-994939b-b2d9a8b7.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 538A 83 KB
25 KB 55ms
55ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 666652b748f9a7861810bb52c2cbf5cf657c33e6ec53afd028455f6f6b7d3124

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 23:46:36 GMT
content-encoding: gzip
age: 44741
x-cache: Hit from cloudfront
content-length: 25087
x-amz-meta-git_commit: 994939b
last-modified: Tue, 15 Dec 2020 23:44:11 GMT
server: AmazonS3
etag: "6aafd7df6c9cdfbf75b4fe30ef0df49f"
x-amz-version-id: PAffgHqhfrCA1Cn3da0x_KJQGmBePJ.s
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: jbMxk2-5QpASZ8wvQWzv_LSJnUVrd6wyjvS18hcgMXBwYukKx8TMZw==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 538A 61 KB
21 KB 63ms
62ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 03 Nov 2020 02:02:02 GMT
content-encoding: gzip
age: 3751815
x-cache: Hit from cloudfront
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: LKX4OIPXCdT35yc3IR_mhagwTVYrDu6hP7bKv2qPBQ2izQUrQBbqAQ==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 538A 133 KB
46 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c300b2811698bc68ed2928ff2686ed40e21753f1d308956268f567ab2149e576

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 47065
x-xss-protection: 0
server: cafe
etag: 860246916715892492
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 16 Dec 2020 12:12:16 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 538A 76 KB
29 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07a3eb8be1687dc1ee377d85bffd51891d0fd539258b63ab4031b012bd77f5fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1607690616793149"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 29432
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:16 GMT

GET
H2 200 bl-994939b-b2d9a8b7.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame E7BD 83 KB
25 KB 68ms
68ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-994939b-b2d9a8b7.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 666652b748f9a7861810bb52c2cbf5cf657c33e6ec53afd028455f6f6b7d3124

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 23:46:36 GMT
content-encoding: gzip
age: 44741
x-cache: Hit from cloudfront
content-length: 25087
x-amz-meta-git_commit: 994939b
last-modified: Tue, 15 Dec 2020 23:44:11 GMT
server: AmazonS3
etag: "6aafd7df6c9cdfbf75b4fe30ef0df49f"
x-amz-version-id: PAffgHqhfrCA1Cn3da0x_KJQGmBePJ.s
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: qwP9G4VkK55LRCTOi4wb9V4qZoKzvCm5k3O9k9wRBqGFUlM_HBVHKg==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame E7BD 61 KB
21 KB 81ms
80ms Script
application/javascript 65.9.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.96.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 03 Nov 2020 02:02:02 GMT
content-encoding: gzip
age: 3751815
x-cache: Hit from cloudfront
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 badae0844eca8f0bad6677607d947120.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: PRG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: xnIMUjqF36L0bqLKh6f6B7vgGrjU9vB1EmO9c2GqMOzc5EWAyYDirA==

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame E7BD 330 B
434 B 9ms
8ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 08:57:07 GMT
x-content-type-options: nosniff
age: 98109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Dec 2021 08:57:07 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201203/r20110914/ Frame E7BD 18 KB
7 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201203/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

631c6a3617e2f5860eaa62155f5200b6ca156c00438445f9862089ef785e4542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 22:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49394
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7483
x-xss-protection: 0
server: cafe
etag: 7789600959769866771
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 29 Dec 2020 22:29:02 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201203/r20110914/client/ Frame E7BD 3 KB
2 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201203/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f8f96b0cc81405b2a95c412dbf43aebae111f11e98ad743b8fff74b2d5c793a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 17:50:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1494
x-xss-protection: 0
server: cafe
etag: 5335486849732140232
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 29 Dec 2020 17:50:10 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame E7BD 76 KB
29 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07a3eb8be1687dc1ee377d85bffd51891d0fd539258b63ab4031b012bd77f5fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1607690616793149"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 29432
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:16 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame E7BD 0
0 14ms
13ms Image
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTHzlYDVd9PB8MLquDWtSe-wmbp8qsU6VX9sEjJfN6CHady_7nAehM9c3gVoBDtJ-8GDxSzuE5rGkf6nNcIoPNiuJPRTQ
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
28 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1c9310eb6a56101c2133db372cfbe9cefb5ff6b90a02ded916984c975b813b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1607690616793149"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28334
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:16 GMT

GET
H2 200 pixel;r=278579095;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D889747...
pixel.quantserve.com/ 35 B
371 B 22ms
15ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=278579095;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI;fpan=1;fpa=P0-1073955254-1608120736887;ns=0;ce=1;qjs=1;qv=58f0669e-20201210192756;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1608120736878;tzo=-60;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F12%2F02155123%2Fcovid%2Ctype.article%2Ctitle.Ransomware%20and%20IP%20Theft%3A%20Top%20COVID-19%20Healthcare%20Security%20Scares%2Cdescription.From%20ransomware%20attacks%20that%20crippled%20hospitals%252C%20to%20espionage%20attacks%20targeting%20%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fransomware-ip-theft-top-covid-19-healthcare-security-scar

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:16 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012010270040000/ Frame 0769 180 KB
50 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15601
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51478
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0305d7d21a7fe4a1"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:16 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0769 13 KB
5 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15587
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4850
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "77bd676d834aaa8d"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:30 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0769 90 KB
27 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15601
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27668
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1304c1c0caf7ca3c"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:16 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0769 3 KB
1 KB 31ms
29ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15587
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1350
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "12c034eb739190af"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:30 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame 0769 41 KB
13 KB 30ms
27ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15601
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13075
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1e8a1dae72af56cd"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:16 GMT

GET
H3-Q050 200 485973749708982978
tpc.googlesyndication.com/simgad/ Frame 0769 113 KB
113 KB 54ms
15ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/485973749708982978?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkeFzeD95EJ6yGJffUD9EL1UHq0Qg

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91c9225038a7e709c9356ec384dc133c3031859517d19e6962d1f1347f6b715e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 00:20:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 27 Sep 2020 07:33:21 GMT
server: sffe
age: 129083
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116062
x-xss-protection: 0
expires: Wed, 15 Dec 2021 00:20:54 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0769 2 KB
3 KB 55ms
16ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 23:34:27 GMT
x-content-type-options: nosniff
server: cafe
age: 45470
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 16 Dec 2020 23:34:27 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0769 295 B
325 B 55ms
17ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 51536
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 16 Dec 2020 21:53:21 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 0769 0
0 67ms
15ms Image
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTVuTeOyGPCcphxqXRFazt_JQBl1Dup7Qw4oAcPuE3zYfeSpsBFFFw0RX1yYrnmlekFaf0XFW6DHNX9e_4cHzZa5SIotw
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 0769 0
0 94ms
41ms Image
text/html 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C3nvon_nZX92eG4HU7_UP3aWwsAz85PnNYLLluoX1C8GEwPz6ARABINGH0iBg-4GAgIgKoAGHg7_3A8gBAuACAKgDAcgDCKoExQNP0Gx05Th5tZvu8GI0flKW_TkypOavGZOLp4EBDSg1HcatrWJl-mZDTQ8FIHmEy25tPwC6dGvQb2iReKhzGfWdB-IZltsY1pvtpi1NhHNkAPjNE18Hj06EKue43omICkbJRVDxzDQDK18TGrWXSF5vKIuLoQunnHQGbIkKigsZEyPU6aGoEvidc8bY024A2Xp08y60GxbR1hWC3r5GeG0sNJF192gpUH455qjanwY6Cvcveg0JNR9W9i7CaSz65QG5n8MqgEFx2LnHQh3ljimNCqCk7ECX6UoWMJMsT4cBL3NCias_5rOS0rOpr1TveRiT48pfP-si3FZoQQ8gzHgbrNpysZr8uvACF_5-GLS32zbr2RT6tg0scdwdTatU66kD7O_6MUWNQNPJJ7rmcrzvbMvRwNYEnjsHcB9uzIFTNkh79xzyLrpH0cvSsqxJ1VT0MkoURxQJDuua9hFzvoln8G89nketBQf7ZYpvYxdLg-nU4RTMUiOPCAS9oTNPy9B4wi-EzquLny_8iuXyFK4wSgg6eadvZcQJueKGxWJI6JZlsAkBLj3qRNLfjqYdIxOKRK984BCBAeKtcEt_NSpRJwtWUiLABLKQl5uMA-AEAZIFBAgEGAGSBQQIBRgEoAYCgAfk9JeJAagH1ckbqAfw2RuoB_LZG6gHlJixAqgHpd8bqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEMSLDtIIBwiAYRABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwHYEw2yFxoKGAgBEhRwdWItOTY4NTczNDQ0NTQ3NjgxNA&sigh=o6aVkKJ1R_w&tpd=AGWhJmtny_M-qsdNODemzS0Pn7okiEjnMfbf3Dq5guDGb_lQLw
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s13-in-f226.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 0769 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ee2a754bfa8192f848668f19b25a93d77da502d3f311893f8fb7550c9ed7ba4

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 120ms
119ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:17 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 234ms
112ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:17 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 4 KB
3 KB 27ms
27ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5d0e7d0bd8b4693b10239e9be46c2c8d5cfc6053c41dd8775abee4a305b2ce53

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:17 GMT
content-encoding: gzip
age: 2943149
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=4042 odim=400x225 ofmt=jpeg
fastly-stats: io=1
content-length: 3173
x-served-by: cache-dca17779-DCA, cache-cdg20760-CDG
access-control-allow-origin: *
x-timer: S1608120737.222159,VS0,VE1
etag: "Ue8r77DYnq0faLiVjMHqJlMlucCvBvjb+Iz0zFQb+wA"
x-amz-request-id: 31DA6B0103C8BCDC
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/jpeg
x-cache-hits: 1, 1

GET
H3-Q050 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012010270040000/ Frame AD3F 180 KB
50 KB 43ms
26ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15602
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51478
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0305d7d21a7fe4a1"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:16 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame AD3F 13 KB
5 KB 41ms
25ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15588
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4850
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "77bd676d834aaa8d"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:30 GMT

GET
H3-Q050 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame AD3F 90 KB
28 KB 38ms
23ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15602
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27668
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1304c1c0caf7ca3c"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:16 GMT

GET
H3-Q050 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame AD3F 3 KB
1 KB 40ms
25ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15588
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1350
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "12c034eb739190af"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:30 GMT

GET
H3-Q050 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012010270040000/v0/ Frame AD3F 41 KB
13 KB 41ms
25ms Script
text/javascript 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 15602
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13075
x-xss-protection: 0
server: sffe
date: Wed, 16 Dec 2020 07:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1e8a1dae72af56cd"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Dec 2021 07:52:16 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AD3F 2 KB
2 KB 14ms
7ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 23:34:27 GMT
x-content-type-options: nosniff
server: cafe
age: 45470
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 16 Dec 2020 23:34:27 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AD3F 295 B
320 B 15ms
8ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 51536
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 16 Dec 2020 21:53:21 GMT

GET
H3-Q050 200 2029859874182056987
tpc.googlesyndication.com/simgad/ Frame AD3F 31 KB
32 KB 24ms
16ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2029859874182056987?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkmY1xZWcK0ALkn_p7zh9K5Tc7u1g

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63ab49600e3575c38059a86f6105ef2454f6c12d0e8c8e486f2700e4f834ec6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 11:30:25 GMT
x-content-type-options: nosniff
last-modified: Sat, 12 Dec 2020 04:03:37 GMT
server: sffe
age: 2512
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32239
x-xss-protection: 0
expires: Thu, 16 Dec 2021 11:30:25 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame AD3F 0
0 63ms
50ms Image
text/html 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C4cd1n_nZX96eG4HU7_UP3aWwsAzZ6rTJYJfXk8_vDLCQHxABINGH0iBg-4GAgIgKoAH2opyYAsgBAuACAKgDAcgDCKoExANP0MaXolDD2o-3nNzoCVBz9zD77PpTYp4H_XDeR5xZYOoyiFT3Bqel6sZboaU2kdWivxg9k0xEXunNB68yNn_VtJSt-UDtYE03RmCKQWy2xi_u7Z3SGrh9xtwevBphV3VicJKRVv5xw_o6Kx0cDOy22kdv8_JKVJzWuTB2ybVH2FX8J7F-IPqfHHGbwCeqPyDKPQN8QRyXV70pXdD0dgLBppyv3w6ZxoPR1sCZ2c5Ydd_KC6aFPTvZIiG7LZFjF5WbumPdwJGaFxUA12hcqlw1j5QZuj7Sm5GmUETToUVodUge4lxd_TQDDirvYBG7t9xLk777zkdFdyuYC3mxhGLTlL0vZuI1r0wUvQStMGlpVmJjuFPk3u3WVqrH7IE5xvRG3cZfN4Pb3luqMc3COt8mTQnx__Vl6sopNoj3R_csnICdX4uFfutMdFTr-DyN-JmBms-roGosrvXz4tY2Sa1JO70FXoqipe8IexTMwhlPnyAenDJLEcPq7u_9FUF-_p59G07oD2o2RTZBGlIxY-Ew8CVxxIkd-NAZu1SM47kObIkmk8H0LXiQdLSD83xRLdPwd4KWfgNaGnaJnEtCqftQhBzvBMAEvd_916AD4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB6Lhtz6oB9XJG6gH8NkbqAfy2RuoB5SYsQKoB6XfG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBC_vArSCAcIgGEQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMNshcaChgIARIUcHViLTk2ODU3MzQ0NDU0NzY4MTQ&sigh=zGv2YxZbgn8&tpd=AGWhJmt32oOJj8ZRJpShP-NFc7UkWgt7lku9VYlDzAsoZ4WOJQ
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s13-in-f226.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame AD3F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db27bc97b116f44f9a3341a377e9a1d03348afb85f3582f142234b79484ea3a3

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 538A 0
0 47ms
47ms Fetch
image/gif 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuZx7Q8dKRorvgGUaBOat9FnIHPqa79pKLQ3vBQFC586VNAQsxnozd2Qo2HHcgR0kSwjiAx4XbwzJQNZgqQ5ZxfIbBAyHZqTKeaXxXSmzUQ5wrXbKLNF_I9dC47Kl_4wk21QGUDhKuYCf6DuS3KRYK4T9J24oolDBUtmVFMTdBBtJbmopt6nIIEBYvwMV6ynq-PVxt0EtCh9RaM_qXCDukUdU4XsJrVkNQQNIGWEkT6nj3rA0QFvpisY1zFyT6qiQZWH_vWg9z1WVZ-2K3M_7fIFg&sig=Cg0ArKJSzJHGHd3oNU04EAE&urlfix=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:18 GMT

GET
DATA 200
OK truncated
/ Frame 538A 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7387ff2ceb2b6e8160b2782e478b7fb6d935de90ef55867f75d246174df7a85

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame E7BD 0
0 46ms
46ms Fetch
image/gif 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJa-VAlSTw6A6K8VPvk1sw0qU3zKCXHStxbq9mC8AodYvaYASVMOKd87ed2mr0iywhIWQHQHT6TTkHbK-55igOZpo-n26JON-5nEvE1_h5B-cgiCcYwSoVNrj85yBboUW8581QR6Rdt4_gCYHvDlZRU-hk9wVQVz0BZMMRnjRZVV9HYi8kIVWUGa8k624ufA7Evco1QZ9vJDuuFqBwBGmv97i_Et7F5lKIkceimtL8soIuXFswilCo5HAGZbTCLDeEj-muJYq2JbJHFZA&sig=Cg0ArKJSzNromS_TZ1vcEAE&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:18 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame E7BD 0
22 B 42ms
42ms Image
image/gif 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssY051MOrabeiuRewdbzfhc8BmO0TxgAhHnWmTsnkaY9rFv4dFzJ7UWizJM9omgvXMEtUfzOh4uKeBsnCnvkXgja0NZptxziOPg1CMv_Lb796eLEqtkUD3CMQOMXpMNFbW795ZiYp6mH_2M4a3TqovvP57TvqTTvwWDVOqB-vVASbDG0ZpvQXpB936M--RXg0b2BgsM8Cg25dmshSK0YrzPEjVCqNXN0padDj63IgWbUDOmZA0OrUraWWrIKs-LPNjc3lo1XO6JC4_nvBcAKg&sig=Cg0ArKJSzOtCvdbt4f4AEAE&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E7BD 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f077a8bc08be05afb0b40eae289d6d5fe83372d1feb60a13b46aae5b8660e76d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/ Frame 538A 234 KB
88 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe5d97969e5d98e03eaacc671edb2e30373f05070f5a37d69f5a5f6f91b79149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 89527
x-xss-protection: 0
server: cafe
etag: 1810063338415286733
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Dec 2020 12:12:18 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/ Frame 3928 0
0 6ms
6ms Document
text/html 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201203/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlDLVsg9X7isJJtkrvUqjKvaEGooF_7_cVsylk2nIgUie2L83YEgcj8Ged5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 16 Dec 2020 09:58:13 GMT
expires: Wed, 30 Dec 2020 09:58:13 GMT
content-type: text/html; charset=UTF-8
etag: 10723747146953794269
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4923
x-xss-protection: 0
age: 8046
cache-control: public, max-age=1209600
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 110ms
109ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:19 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 0769
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

15ms
14ms

Image
text/html

2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 16 Dec 2020 12:12:19 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 309 B
350 B 26ms
25ms XHR
application/x-mpegurl 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:19 GMT
content-encoding: gzip
last-modified: Mon, 07 Sep 2020 18:49:42 GMT
age: 1318211
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
x-served-by: cache-bwi5150-BWI, cache-cdg20738-CDG
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120739.494234,VS0,VE1
content-length: 164
x-cache-hits: 1, 1

GET
H2 200 485973749708982978
tpc.googlesyndication.com/simgad/ Frame 0769 113 KB
114 KB 7ms
6ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/485973749708982978?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkeFzeD95EJ6yGJffUD9EL1UHq0Qg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91c9225038a7e709c9356ec384dc133c3031859517d19e6962d1f1347f6b715e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Dec 2020 00:20:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 27 Sep 2020 07:33:21 GMT
server: sffe
age: 129085
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116062
x-xss-protection: 0
expires: Wed, 15 Dec 2021 00:20:54 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0769 2 KB
3 KB 7ms
7ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 23:34:27 GMT
x-content-type-options: nosniff
server: cafe
age: 45472
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 16 Dec 2020 23:34:27 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0769 295 B
325 B 9ms
8ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 51538
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 16 Dec 2020 21:53:21 GMT

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame AD3F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

29ms
18ms

Image
text/html

2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 16 Dec 2020 12:12:19 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050 200 2029859874182056987
tpc.googlesyndication.com/simgad/ Frame AD3F 31 KB
32 KB 7ms
6ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2029859874182056987?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkmY1xZWcK0ALkn_p7zh9K5Tc7u1g

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63ab49600e3575c38059a86f6105ef2454f6c12d0e8c8e486f2700e4f834ec6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 11:30:25 GMT
x-content-type-options: nosniff
last-modified: Sat, 12 Dec 2020 04:03:37 GMT
server: sffe
age: 2514
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32239
x-xss-protection: 0
expires: Thu, 16 Dec 2021 11:30:25 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AD3F 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 23:34:27 GMT
x-content-type-options: nosniff
server: cafe
age: 45472
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 16 Dec 2020 23:34:27 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame AD3F 295 B
320 B 10ms
9ms Image
image/png 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 15 Dec 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 51538
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 16 Dec 2020 21:53:21 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 538A 0
45 B 43ms
42ms Image
image/gif 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsueM-BPyfl-TVXs-_SWurhbhc-JlT9AzEumJQIu5p-cma9ah2SjPY5Hc1JoKvr0ytex0zyx4NAsDUu4_eEGIRsJWVe9nUXJLqa2_wjCnG-FuS040-o89m1BtZzZXwZxNh9WVzXGyRHBz_3duyLvnOc76mvbSuf1IATWQoJPBXK62NcUxzZjPq09KmcwsqQcDnUMpaOOwo2FinSg-MAykK7qBwHnERtd1ELIWPbvEEsqx0nlGEaxY7bwp_bs7m5WX6QI5etrr6fzQTEV2nl10JlCrCaS&sig=Cg0ArKJSzH01YAy8Gt76EAE&urlfix=1&adurl=

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 223ms
145ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Wed, 16 Dec 2020 12:12:20 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: df4b5716c8e8499f18811c5b6e2e0b39
x-transaction: 00a7fc9a00628903
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 60ms
43ms XHR
application/json 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020120801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44673469cc0d56cbaa555124625e9fc20f4ecccabde3e19767e36bb23c003efb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6582
x-xss-protection: 0

GET
H2 200 0.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 5 KB
1 KB 25ms
22ms XHR
application/x-mpegurl 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 1150957
etag: "3a71266b043248350b2f39a55da8294e"
x-served-by: cache-bwi5136-BWI, cache-cdg20738-CDG
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120740.083342,VS0,VE1
content-length: 959
x-cache-hits: 1, 1

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 538A 204 B
394 B 64ms
59ms Script
text/javascript 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=threatpost.com&callback=_gfp_s_&client=ca-pub-7500593236707325

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

bc0e5f55b7d45fbfd0679f2176ac224331a7771a02e426574d13cdd71dbbd470

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 192
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 538A 109 B
169 B 15ms
14ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 538A 109 B
169 B 18ms
17ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 6B78 0
0 200ms
200ms Document
text/html 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186319&pi=t.ma~as.7785652766&w=300&fwrn=3&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ea=0&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1608120738944&bpp=113&bdt=2343&idt=1020&shv=r20201203&cbv=r20190131&ptt=9&saldr=aa&correlator=6519220517039&frm=23&ife=4&pv=2&ga_vid=371802538.1608120740&ga_sid=1608120740&ga_hid=1983266361&ga_fc=0&nhd=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1082&ady=1758&biw=1600&bih=1200&isw=300&ish=600&ifk=2061636368&scr_x=0&scr_y=0&eid=21066699%2C21066792%2C182982000%2C182982200%2C21067982&oid=3&pvsid=1263228587710794&pem=492&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.uaxq83623l63&btvi=1&fsb=1&dtd=1240

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186319&pi=t.ma~as.7785652766&w=300&fwrn=3&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ea=0&flash=0&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1608120738944&bpp=113&bdt=2343&idt=1020&shv=r20201203&cbv=r20190131&ptt=9&saldr=aa&correlator=6519220517039&frm=23&ife=4&pv=2&ga_vid=371802538.1608120740&ga_sid=1608120740&ga_hid=1983266361&ga_fc=0&nhd=1&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1082&ady=1758&biw=1600&bih=1200&isw=300&ish=600&ifk=2061636368&scr_x=0&scr_y=0&eid=21066699%2C21066792%2C182982000%2C182982200%2C21067982&oid=3&pvsid=1263228587710794&pem=492&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.uaxq83623l63&btvi=1&fsb=1&dtd=1240
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlDLVsg9X7isJJtkrvUqjKvaEGooF_7_cVsylk2nIgUie2L83YEgcj8Ged5; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 16 Dec 2020 12:12:20 GMT
server: cafe
content-length: 205
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 538A 8 KB
6 KB 27ms
26ms XHR
application/json 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201203&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d402b74eb1279acb6d73065224e41f2a489e40632be49b4e2333e3f0e778908

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6377
x-xss-protection: 0

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 538A 74 KB
28 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1c9310eb6a56101c2133db372cfbe9cefb5ff6b90a02ded916984c975b813b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1607690616793149"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28334
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:20 GMT

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:20 GMT

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 1 KB
2 KB 30ms
29ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-1428

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 4043252
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5134-BWI, cache-cdg20738-CDG
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 0-1428/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120740.291904,VS0,VE0
access-control-allow-origin: *
Content-Length: 1429
x-cache-hits: 1, 1

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 23ms
23ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 16 Dec 2020 12:12:20 GMT
x-served-by: cache-cdg20738-CDG
x-cache: HIT
x-cache-hits: 0
x-timer: S1608120740.266532,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2

200

pd
eu-u.openx.net/w/1.0/ Frame D40F
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0

0
0

44ms
38ms

Document
text/html

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=eef71046-5a14-0464-1ad5-aafd99e06165|1608120740
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=eef71046-5a14-0464-1ad5-aafd99e06165|1608120740; Version=1; Expires=Thu, 16-Dec-2021 12:12:20 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1608120740|gekin0vNiygu; Version=1; Expires=Thu, 31-Dec-2020 12:12:20 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 16 Dec 2020 12:12:20 GMT
content-type: text/html
content-length: 417
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

set-cookie: i=eef71046-5a14-0464-1ad5-aafd99e06165|1608120740; Version=1; Expires=Thu, 16-Dec-2021 12:12:20 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
date: Wed, 16 Dec 2020 12:12:20 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2 200 sync.html
public.servenobid.com/ Frame 1EBA 0
0 115ms
9ms Document
text/html 2620:1ec:bdf::13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Tue, 08 Dec 2020 18:28:18 GMT
accept-ranges: bytes
etag: "7f0ebc00c655e7bc1d3aad91e4b7e718"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: 8PGYJcCjQYpXajKxmtJ2o2rbr1t9AvlKSXHpmXg2+BAytk7H4lcr3Tm8aSBvmkJPPnfeqMHJYlc=
x-amz-request-id: 5F8119ED5D561CB7
x-azure-ref-originshield: 06bfYXwAAAADwMCbATy9FTLm1FUvUx69MTE9OMjFFREdFMDEyMgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0pPnZXwAAAACUzcPv6gt9R6VHKjLtQzaMRlJBRURHRTEwMTAAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date: Wed, 16 Dec 2020 12:12:20 GMT

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame DB75
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

228ms
33ms

Document
text/html

205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

Date: Wed, 16 Dec 2020 12:12:21 GMT
Connection: Keep-Alive
Cache-Control: max-age=20975
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx000000000000004253048-005fd8f824-43b5652-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Age: 495
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1608120740.dop214.pa1.t,1608120741.cds211.pa1.shn,1608120741.dop214.pa1.t,1608120741.cds204.pa1.c

Redirect headers

content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1

200
OK

Cookie set beacon
ap.lijit.com/ Frame EF80
Redirect Chain

https://ap.lijit.com/beacon?informer=13394437
https://ap.lijit.com/beacon?informer=13394437&dnr=1

0
0

103ms
50ms

Document
text/html

216.52.2.48
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Host: ap.lijit.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ljt_reader=3e39941db8ed42518c5385bd
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

Server: nginx
Date: Wed, 16 Dec 2020 12:12:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Set-Cookie: ljtrtbexp=eJxlkDsSgEAIQ%2B%2BytQXfBbya490dVxuy5cuQELgGj5MnpVCw0TFkYamSvjhnZ%2B0Y3NmJQGHqXFUOGd%2BKDHFfDtkcsSnZlYQtDLUTeqcBQ6cEv6AfGsl%2FA0%2BtxdFvUsgzyLOCP8K8J361N7ofpAxYMw%3D%3D;Path=/;Domain=.lijit.com;Expires=Thu, 16-Dec-2021 12:12:20 GMT;Max-Age=31536000;Secure;SameSite=None ljt_reader=3e39941db8ed42518c5385bd;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap5ams1

Redirect headers

Server: nginx
Date: Wed, 16 Dec 2020 12:12:20 GMT
Content-Length: 0
Set-Cookie: ljt_reader=3e39941db8ed42518c5385bd;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ap.lijit.com/beacon?informer=13394437&dnr=1
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap5ams1

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 38DC 0
0 135ms
39ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Thu, 03 Dec 2020 21:09:36 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 16 Dec 2020 12:12:20 GMT
Age: 54140
X-Served-By: cache-lga21927-LGA, cache-fra19126-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 264448
X-Timer: S1608120740.481824,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

sync
eb2.3lift.com/ Frame 7339
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

41ms
40ms

Document
text/html

18.192.150.244
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.192.150.244 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-192-150-244.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=17144745668712827161
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-type: text/html; charset=utf-8
content-length: 539
set-cookie: sync=CgoIgQIQntfc2-YuCgoI4gEQntfc2-YuCgoI5gEQntfc2-YuCgoIhwIQntfc2-YuCgkIORCe19zb5i4KCQg6EJ7X3NvmLgoJCAsQntfc2-YuCgoIjAIQntfc2-YuCgkIXxCe19zb5i4KCQgfEJ7X3NvmLg==; Max-Age=7776000; Expires=Tue, 16 Mar 2021 12:12:20 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=17144745668712827161; Max-Age=7776000; Expires=Tue, 16 Mar 2021 12:12:20 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-length: 0
set-cookie: tluid=17144745668712827161; Max-Age=7776000; Expires=Tue, 16 Mar 2021 12:12:20 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame FFAB 0
0 114ms
38ms Document
text/html 184.24.15.122
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.24.15.122 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-15-122.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Mon, 28 Sep 2020 17:02:39 GMT
ETag: "40295-123-5b062a240e9c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 238
Content-Type: text/html; charset=UTF-8
Date: Wed, 16 Dec 2020 12:12:20 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 0D9F 0
0 61ms
61ms Document
text/html 104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Wed, 16 Dec 2020 12:12:20 GMT
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 096F 0
0 147ms
55ms Document
text/html 104.108.144.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.214 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-214.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=31747
Expires: Wed, 16 Dec 2020 21:01:27 GMT
Date: Wed, 16 Dec 2020 12:12:20 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D296a6f96-52f9-4c99-ad9f-823c83c2b237%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=appnexus&uid=7015098911700843152

0
116 B

127ms
107ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=appnexus&uid=7015098911700843152
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy

Redirect headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:20 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.84:80
AN-X-Request-Uuid: 5923d87b-ea37-4fee-882d-e839e8e887e6
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=appnexus&uid=7015098911700843152
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=sovrn&uid=3e39941db8ed42518c5385bd

0
140 B

127ms
112ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=sovrn&uid=3e39941db8ed42518c5385bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy

Redirect headers

Date: Wed, 16 Dec 2020 12:12:20 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=296a6f96-52f9-4c99-ad9f-823c83c2b237&D=&bidder=sovrn&uid=3e39941db8ed42518c5385bd
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200
OK

usermatchredir
ssum.casalemedia.com/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1

43 B
750 B

101ms
85ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:20 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 16 Dec 2020 12:12:20 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:20 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D296a6f96-52f9-4c99-ad9f-823c83c2b237%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 370
Expires: Wed, 16 Dec 2020 12:12:20 GMT

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 444 KB
445 KB 39ms
24ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=1429-456334

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 4043253
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5134-BWI, cache-cdg20738-CDG
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 1429-456334/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120741.794443,VS0,VE0
access-control-allow-origin: *
Content-Length: 454906
x-cache-hits: 1, 2

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 538A 16 KB
6 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Wed, 16 Dec 2020 12:12:20 GMT

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 44ms
44ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 16 Dec 2020 12:12:20 GMT
x-served-by: cache-cdg20738-CDG
x-cache: HIT
x-cache-hits: 0
x-timer: S1608120741.739528,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame E3BC 0
0 100ms
17ms Document
text/html 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4867
date: Wed, 16 Dec 2020 11:19:57 GMT
expires: Thu, 16 Dec 2021 11:19:57 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3144
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 0769 42 B
168 B 224ms
32ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstEzg_-qqCKrT3nFQt99Q9k7cqA9MCC0rko44oxus7HksVD10Fcdi7g7DYFu7wnbO2-a8doyAI3McxWSQELBbEIzpDMr5ja9FcPRJ3JOmRIszV8sdzPpBLtLEY&sai=AMfl-YRcH5RKs4NZjlSClca0hC5EvNypZduXOq9RwNBBJ95iJtB8fWccT6Q2XT2Jd4bGQtidUyBPZrF7HCbbnWtFmNxe8hHOWdVGiJJsyPRsYN6eapCCFvl2fq5Jkf1O&sig=Cg0ArKJSzKznMwAcTENYEAE&cid=CAASFeRoFn817Wy7cDs2Fx85Zaz2OnVrAw&id=ampim&o=315,10&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1147&mtos=0,0,0,1147,1147&tos=0,0,0,1147,0&tfs=785&tls=1932&g=100&h=100&tt=1932&r=v&avms=ampa&adk=1015519800

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame AD3F 42 B
66 B 39ms
23ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvjshdk0VlB92H8Xh1cer3fkjBKDs1awXftoKJgXClsJGmS5DH_yOvXL6kPGS5uwYropfbhQyC7xvsTleTivdXvDKmyrdyL_rgV_6vmDmGyd_seWrbHd9KzACs&sai=AMfl-YQ7mxCq3Pf96Lm1MJdTyRyMeU7js5hsVM0lGjvksVNsKm490svdxR7KyaVUqa_kfksrO0I0Ct-mlE5LTnm6T3rMgqJqakRo6_AiXuadKDV8t7uZ2aQZn46mELuZ&sig=Cg0ArKJSzKC1iGaMqiQGEAE&cid=CAASFeRoZjxAgz0rcfws9r2qu0CqRc3Vmg&id=ampim&o=1064,417&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1326&mtos=0,0,1326,1326,1326&tos=0,0,1326,0,0&tfs=370&tls=1696&g=100&h=100&tt=1696&r=v&avms=ampa&adk=654286612

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame 6D79 0
0 64ms
31ms Document
text/html 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4867
date: Wed, 16 Dec 2020 11:19:57 GMT
expires: Thu, 16 Dec 2021 11:19:57 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3144
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 390 KB
390 KB 74ms
38ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=456335-855191

Response headers

date: Wed, 16 Dec 2020 12:12:21 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 4043254
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5134-BWI, cache-cdg20738-CDG
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 456335-855191/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120742.936536,VS0,VE0
access-control-allow-origin: *
Content-Length: 398857
x-cache-hits: 1, 3

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 111ms
110ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:21 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 22ms
21ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 16 Dec 2020 12:12:21 GMT
x-served-by: cache-cdg20738-CDG
x-cache: HIT
x-cache-hits: 0
x-timer: S1608120742.877625,VS0,VE0
cache-control: max-age=31557600
content-length: 0

POST
H/1.1 200
OK g Show response
capi.connatix.com/rtb/ Frame 98AA 332 B
542 B 313ms
230ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/rtb/g?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: a758c75dd51e9e53aacd10a22ac8ae2beae57fc0bd9d4297ce2b21106bdd5f5e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:23 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 prebid4.17.0.js Show response
cds.connatix.com/p/plugins/ Frame 98AA 290 KB
92 KB 216ms
36ms Script
application/javascript 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cb2b06b14c047c2794ee42fb17fc63548df57a7f157a59cbd5dc0a7dfa145e7d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:23 GMT
via: 1.1 varnish, 1.1 varnish
age: 1885462
x-cache: HIT, HIT
content-encoding: gzip
content-length: 93427
x-served-by: cache-dca17775-DCA, cache-cdg20760-CDG
last-modified: Tue, 24 Nov 2020 16:25:19 GMT
x-timer: S1608120743.299190,VS0,VE0
etag: "8cec0767f1a972bb22251c7286e5b434"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 3660

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 246ms
136ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:23 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 98AA 0
215 B 766ms
270ms XHR
application/json 3.123.45.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.45.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content mvo Show response
tag.1rx.io/rmp/216475/0/ Frame 98AA 0
271 B 107ms
77ms XHR
text/plain 213.19.147.210
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/216475/0/mvo?z=1r&hbv=4.17,2.1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:23 GMT
Cache-Control: private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Server: Tengine
Connection: keep-alive

POST
H/1.1 204
No Content mvo Show response
tag.1rx.io/rmp/216476/0/ Frame 98AA 0
271 B 393ms
116ms XHR
text/plain 213.19.147.210
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/216476/0/mvo?z=1r&hbv=4.17,2.1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:24 GMT
Cache-Control: private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Server: Tengine
Connection: keep-alive

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 98AA 0
59 B 289ms
78ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
date: Wed, 16 Dec 2020 12:12:23 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ Frame 98AA 24 B
372 B 581ms
153ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?t=900&s=435870&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2293aedb51ac3ef8%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22dms%22%3Atrue%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%2C%22rid%22%3A%22683f6827-b454-42f6-bbeb-39c72926ede7%22%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%221075b44991975ce%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%7D
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5ca88677a001e263cc38ed080f5e6534769ae910047eaa45324008ab8a9ba4c9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:24 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[FR], RC:[IDF], CN:[EU], CIP:[82.102.18.114], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
x-cs-client-geo: 28
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
x-ak-client-geo: 28
expires: Wed, 16 Dec 2020 12:12:24 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 98AA 0
59 B 281ms
0ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
date: Wed, 16 Dec 2020 12:12:24 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ Frame 98AA 25 B
373 B 544ms
129ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?t=900&s=435871&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%22134a1f521d3482a%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22dms%22%3Atrue%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%2C%22rid%22%3A%22683f6827-b454-42f6-bbeb-39c72926ede7%22%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2214e274ccca5dc4d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%7D
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 83b61bb90a331478d5e78e1e6f6d9a91f808b4ce2fc6624364acd52bd6307e21

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:24 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[FR], RC:[IDF], CN:[EU], CIP:[82.102.18.114], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
x-cs-client-geo: 28
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 28
expires: Wed, 16 Dec 2020 12:12:24 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 98AA 142 B
1 KB 285ms
62ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

bedcbc82d42e7e12bb8575c395e83caede7352387eea33b1984be7e736b65aff

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:24 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.41:80
AN-X-Request-Uuid: d30f1db2-cda5-4c5e-ad73-d9815ba924d6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 142
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 98AA 92 B
282 B 425ms
35ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=6aa7aa57-f6b4-4ea5-974f-1f514fd5fb62&nocache=1608120743843&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C683f6827-b454-42f6-bbeb-39c72926ede7%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:24 GMT
via: 1.1 google
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 98AA 92 B
285 B 410ms
32ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=9146261c-13ec-4ef9-871d-b9807d9b15d2&nocache=1608120743862&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C683f6827-b454-42f6-bbeb-39c72926ede7%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:24 GMT
via: 1.1 google
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 98AA 144 B
1 KB 221ms
123ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

58f97b53045d4b853f7dab98bf25aaf6dfcf165e755d9ce03b585c53089f9aed

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:24 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.102:80
AN-X-Request-Uuid: 31f3a383-eac5-4e3b-9296-7338013e4cbd
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
63 B 382ms
12ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020120801&jk=2437964433651654&bg=!s7ClsJDNAAXKjztBylhLjOnRiANH2wIAAAUgUgAAAIloAQcKATpR8xOUc6oG3KEU4y0RtlMGWkMhUIjzMDhineM8OFDqzs6TrcewtlcbYXQVQAwP224hxBNraiWLoFYzcTwwakh_QQeQPz222276Tb4GQd3XyvUQTghr5fnOVPUsxpD6m_Iexk0NZvcwchz0Lm73dzKdF1CGIUGCm1DJy5vxga-DXd4j_cqLeN-oDCsE8KGITeqG2E4Yi5j0eOFWy0x9TLoNKb0vRwQwVnMeKOO-ZXV_tJd6TGKoPrmag7tQfRWtqXzAUgHa7VxJ3LnlCm5UuIgGAS0bxE_FSu1xXXkk7dza316zju4f1JbBDELXqq8OOJFowWmA2K7O8Y7JRwFIQMCgsJ4txUDRLY-bsMaHpEMkjK1AwrqRlHxxQcousY_ri_pFTwf6LgxaH0S6c-0HKHFaykEG6jOoUnN3UJkBtx2j0tMVQPK0Hbb-0I-qjKTxRr0P5qHML74BiKFDvtC_i9rnPh7Tw4oyTW7AvrDdpsdknJdz-j5HsEqn-bz5MfAwAx5FF0yLN2ZB0Xxa9p0YV51cSrCEUyLoFHCZn9jd9_6g5iqHEA_FSOzC4IuYmbkvYuh-dIWrkRd4mjbO1yv1cRpqTetrgm7tiNBJUrmBO9DPQksiWlLUBe7LlYDB_9oM3C-gbt-qPCr7X7VOIgEZmG_kNCmTNZ5wozzLpy4XdYzW-0q-7z7S8r2rwkyWwp6QTvC3PURQVndZhJ62sM4tcLtJSZ41SuMYH2r6tHx4MaTeuGdU5HpyclvqBW-RwShPs1H28XH8DjtnkjMARLq6bWVTnClGSZE4zY45nemcFZqjUZrODBMA3Bmaxtvrxc7XSPkk1TAVe-fAAOBw_QRYQraLsp5AiBekLUoFAtH1Kr_uLZc0EdgN8LgQvE3LhaskzWjqcSLAiSauBhF0UkugBSrpzxXwPmSraAjx5squeW1LN6jVbyUABjjLFNCu8FKp_3FL9pccbLxt6SF9lpfVTisgDhllHQg0GVVKL8k2iKeHBOW3LHk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 538A 0
63 B 91ms
17ms Image
image/gif 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gda_r20201203&jk=1263228587710794&bg=!5eal5sbNAAUbEDgJG1h5mpHiZxzXUgIAAAZNUgAAAH5oAQcKAe4tI4KhZySa6qN0Gf6Sb0Q2w1AAoZqMoOb9Q7U42Z_eIJGNjUENcOBnI1NcobGMaVKvvAczlvlMoVIfYYtJ4b11PF-tpQCPxiMsoGLlCZYIn4csMId9ZCpCiUBqpXOfTc3zJtD8S4Ozmvdx00WxyPoonqYiR5Z04trqecQ_Q00IEEipjAys2TD9pNMw6aIbmatZQOn1Ol7TWkCjluUY9g598Z2BTgZPDBOVz8zGesNcI_ZwrV2Jb1gKvyXwQbNZwxGf5rY7alb20PR70OXJeKsQf1njLMfO_fJ-wytn0N22lFfwv01c9HkzB6EIUdxS9n6RILYfyzjUwfjb1akgMkJoNFYYLhn787EwLGIhYh5RWZV4EShn4GpNEIImezWXSpkuWnEmtZvcd8ErY2qyUHu6EJEec8eH5aNoWLb-2flERlzDIYkVjiVL3xjgF3Uw53J2cpRUvEm40FMvTZgoD3toXqDDwv2cDkm1A2J2BMbD3T6RyCaFl8OpXWRL00LP-Mo2ASd_Z8L38FhnP5JbNCfFtCnHHeS5wpo5qSAeRpugIBnp_WDL15oSNkLOPvLNKeoXOrR1HkcOJ7fAI2pynOZqITaO6VSpFMgSFW7V4rQYxWJmutqAUzBtbeOo0szLtsVlfR1rL-SBzEpjj6LWMpkBzZHUCsNDITOjFyQOD5O6y4e7ZNn_JtEp_tdI9ZV_I-5o66xIx4VhXUQjzm6hVe1moHrjGd38IckA41yskiDKn1jdNXTQY9HSKZiNy-sfru9yO4LTNLb54e5Zt1nX8tNPpzuBcyPS4CesCbIbEf2NgGptdjqz7EdBJzPNrkbeZk40tlUBIyXsDsd-Ql4eSZrFW3JsxuPdgdJAyW0h6tm60ULvDKjUVUS2SW3QW9DJm4dE0XGHJL7bpmQ_2rccVR2qltBrkhfmFx9_g0ntWSRtqtElU2nfoqtFpT-B38g9W8QWW_lqEvPTArfcSNG1zUR-rW5z4r6bwg9U6h9bqVNVOihaWFc6hoelnkl7Hk8j27OeggoJYqFchLZpftE_11MLrBkO8YLcCRFCcVe00_r0CUYlPrFjaAXxGbxppIQofJ0w63YjwEtzenQGZ-hGVR3bnsAdCAdHd-kuEY2yIf-_9GYQ0iiAow4CNtW3dhfyTRt9rjxZ3PA7m5Gfp_1tq9AnHwcaSeytKWL6OI_2UFWDTx1cCC6KCYukB1I1jNnIc_zF2R1ZGORrWNRsAR4C2rmGM7EeiKGrEfyzkq-K6RpiWzjbOID-MFDoUrkRScK0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 7E61 0
0 53ms
52ms Document
text/html 104.108.144.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.214 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-214.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PUBMDCID=3; KRTBCOOKIE_80=16514-CAESEKbFhJO__Zq7HqJ8e-NA3mE&KRTB&22987-CAESEKbFhJO__Zq7HqJ8e-NA3mE&KRTB&23025-CAESEKbFhJO__Zq7HqJ8e-NA3mE; KRTBCOOKIE_391=22924-2690555815493832198; PugT=1608120743; KTPCACOOKIE=YES; KRTBCOOKIE_377=6810-fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&KRTB&22918-fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&KRTB&23031-fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9; KCCH=YES; pi=156212:4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=31740
Expires: Wed, 16 Dec 2020 21:01:27 GMT
Date: Wed, 16 Dec 2020 12:12:27 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame A9F8 0
0 51ms
50ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: icu=ChgIzLJhEAoYASABKAEwqPPn_gU4AUABSAEQqPPn_gUYAA..; uuid2=9119038270865654943
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Thu, 03 Dec 2020 21:09:36 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 16 Dec 2020 12:12:27 GMT
Age: 54147
X-Served-By: cache-lga21927-LGA, cache-fra19126-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 264493
X-Timer: S1608120747.081400,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame AED6 0
0 53ms
52ms Document
text/html 104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Wed, 16 Dec 2020 12:12:27 GMT
Connection: keep-alive

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame F70D 0
0 67ms
48ms Document
text/html 104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Wed, 16 Dec 2020 12:12:27 GMT
Connection: keep-alive

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 5833 0
0 33ms
32ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=6e9af801-765c-443b-85df-a94992a548d6|1608120743
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=6e9af801-765c-443b-85df-a94992a548d6|1608120743; Version=1; Expires=Thu, 16-Dec-2021 12:12:27 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1608120747|gekin0vNiygu; Version=1; Expires=Thu, 31-Dec-2020 12:12:27 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 16 Dec 2020 12:12:27 GMT
content-type: text/html
content-length: 416
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame D85B 0
0 38ms
37ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: icu=ChgIzLJhEAoYASABKAEwqPPn_gU4AUABSAEQqPPn_gUYAA..; uuid2=9119038270865654943
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Thu, 03 Dec 2020 21:09:36 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 16 Dec 2020 12:12:27 GMT
Age: 54147
X-Served-By: cache-lga21927-LGA, cache-fra19126-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 264496
X-Timer: S1608120747.181250,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 3B18 0
0 30ms
30ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=6e9af801-765c-443b-85df-a94992a548d6|1608120743; pd=v2|1608120747|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=6e9af801-765c-443b-85df-a94992a548d6|1608120743; Version=1; Expires=Thu, 16-Dec-2021 12:12:27 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1608120747|mWkigqiysLommOgevNgunsn0; Version=1; Expires=Thu, 31-Dec-2020 12:12:27 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 16 Dec 2020 12:12:27 GMT
content-type: text/html
content-length: 316
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 4707 0
0 51ms
50ms Document
text/html 104.108.144.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.214 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-214.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PUBMDCID=3; KRTBCOOKIE_80=16514-CAESEKbFhJO__Zq7HqJ8e-NA3mE&KRTB&22987-CAESEKbFhJO__Zq7HqJ8e-NA3mE&KRTB&23025-CAESEKbFhJO__Zq7HqJ8e-NA3mE; KRTBCOOKIE_391=22924-2690555815493832198; PugT=1608120743; KTPCACOOKIE=YES; KRTBCOOKIE_377=6810-fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&KRTB&22918-fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&KRTB&23031-fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9; KCCH=YES; pi=156212:4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=31740
Expires: Wed, 16 Dec 2020 21:01:27 GMT
Date: Wed, 16 Dec 2020 12:12:27 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame 98AA
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9

0
124 B

40ms
34ms

Image
text/plain

52.28.254.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.254.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 12:12:27 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=fbee2cb2-8e00-471f-ad34-8d4aa8d8e3d9
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55986/ Frame 98AA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X9n5qwAAALbJDToG&_origin=0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X9n5qwAAALbJDToG&_origin=0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8

0
976 B

36ms
32ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55986/sync?uid=X9n5qwAAALbJDToG&_origin=0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.128 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 12:12:27 GMT
Server: ATS/7.1.2.128
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55986/sync?uid=X9n5qwAAALbJDToG&_origin=0&gdpr=0&gdpr_consent=&_test=X9n5qwAAALbJDToG&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8
date: Wed, 16 Dec 2020 12:12:27 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 98AA
Redirect Chain

https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8
https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVBmNjVkYjU4Ni0zZjk3LTExZWItOWM5OC0wNmY5MzgxMjRjZTg%3D
https://pixel.advertising.com/ups/57304/sync?uid=CAESEJ6t3BEMAq4ZuBN7o2KMP8M&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJ6t3BEMAq4ZuBN7o2KMP8M&google_cver=1&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8

0
976 B

38ms
37ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJ6t3BEMAq4ZuBN7o2KMP8M&google_cver=1&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.128 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 12:12:27 GMT
Server: ATS/7.1.2.128
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJ6t3BEMAq4ZuBN7o2KMP8M&google_cver=1&apid=UPf65db586-3f97-11eb-9c98-06f938124ce8
date: Wed, 16 Dec 2020 12:12:27 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 116ms
112ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:27 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 98AA 0
301 B 114ms
113ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:31 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 98AA 407 KB
407 KB 89ms
86ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=855192-1271452

Response headers

date: Wed, 16 Dec 2020 12:12:33 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 4043265
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5134-BWI, cache-cdg20738-CDG
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 855192-1271452/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1608120753.115512,VS0,VE0
access-control-allow-origin: *
Content-Length: 416261
x-cache-hits: 1, 4

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 23ms
23ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 16 Dec 2020 12:12:33 GMT
x-served-by: cache-cdg20738-CDG
x-cache: HIT
x-cache-hits: 0
x-timer: S1608120753.086731,VS0,VE0
cache-control: max-age=31557600
content-length: 0

POST
H/1.1 200
OK g Show response
capi.connatix.com/rtb/ Frame 98AA 102 B
426 B 147ms
147ms XHR
multipart/form-data 18.218.223.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/rtb/g?v=84835
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.218.223.45 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-218-223-45.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: 3a1a3b9f64e377ef65125f330e02aa65392c5c112ce8082f096c0070899b63da

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 16 Dec 2020 12:12:33 GMT
Content-Encoding: br
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 98AA 0
215 B 323ms
251ms XHR
application/json 3.123.45.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.45.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content mvo Show response
tag.1rx.io/rmp/216475/0/ Frame 98AA 0
271 B 54ms
54ms XHR
text/plain 213.19.147.210
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/216475/0/mvo?z=1r&hbv=4.17,2.1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:33 GMT
Cache-Control: private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Server: Tengine
Connection: keep-alive

POST
H/1.1 204
No Content mvo Show response
tag.1rx.io/rmp/216476/0/ Frame 98AA 0
271 B 45ms
44ms XHR
text/plain 213.19.147.210
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/216476/0/mvo?z=1r&hbv=4.17,2.1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://threatpost.com
Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:33 GMT
Cache-Control: private, max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Server: Tengine
Connection: keep-alive

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 98AA 0
59 B 86ms
86ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
date: Wed, 16 Dec 2020 12:12:33 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ Frame 98AA 25 B
373 B 252ms
252ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?t=900&s=435870&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2239dc6be29890276%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22dms%22%3Atrue%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%2C%22rid%22%3A%22415a76aa-99c3-4544-91a1-8341d67b4b7b%22%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2240692b9f8d21a08%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%7D
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b0c292b76ddcfdff8f2343afbb1bfaec2b017b7b5b590766c15aad8aa92cf8c5

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:33 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[FR], RC:[IDF], CN:[EU], CIP:[82.102.18.114], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
x-cs-client-geo: 28
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 28
expires: Wed, 16 Dec 2020 12:12:33 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 98AA 0
59 B 85ms
84ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
date: Wed, 16 Dec 2020 12:12:33 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ Frame 98AA 25 B
373 B 83ms
81ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?t=900&s=435871&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2243608e5dccfe226%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22dms%22%3Atrue%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%2C%22rid%22%3A%22415a76aa-99c3-4544-91a1-8341d67b4b7b%22%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2244fc9c581c7facd%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%7D
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 85e923c996c5743f3d79cd633c520a4709ecbaef8441def15e92e952db3d54bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:33 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[FR], RC:[IDF], CN:[EU], CIP:[82.102.18.114], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
x-cs-client-geo: 28
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 28
expires: Wed, 16 Dec 2020 12:12:33 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 98AA 144 B
1 KB 46ms
46ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

52e9f353d2948f63c91ec1c5535870823f3d7baba88adc47f37e21737b5911c3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:33 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.49:80
AN-X-Request-Uuid: 1bf49ee8-e458-4249-8ed1-3ec64ee73ddb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 98AA 92 B
282 B 38ms
37ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=5d8227f1-ef3c-426c-9ffa-713c1913510d&nocache=1608120753172&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C415a76aa-99c3-4544-91a1-8341d67b4b7b%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:33 GMT
via: 1.1 google
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 98AA 92 B
282 B 37ms
37ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fransomware-ip-theft-top-covid-19-healthcare-security-scares%2F162247%2F%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=54f879cf-6dc3-4426-af54-296dde77c2e3&nocache=1608120753175&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C415a76aa-99c3-4544-91a1-8341d67b4b7b%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.199.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Dec 2020 12:12:33 GMT
via: 1.1 google
server: OXGW/16.199.0
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 98AA 144 B
1 KB 59ms
58ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.17.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

bbb61adef560ac5da24d811a2d8f690935e11454438137262ec4b68c9a14f6c7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 16 Dec 2020 12:12:33 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.42:80
AN-X-Request-Uuid: 39a11f32-e296-4213-97a4-91697a141712
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Verdicts & Comments Add Verdict or Comment

307 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
threatpost.com/	1970-01-19 23:27:36	Name: usprivacy Value: 1---
.doubleclick.net/	1970-01-19 14:42:04	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 00:03:36	Name: IDE Value: AHWqTUlDLVsg9X7isJJtkrvUqjKvaEGooF_7_cVsylk2nIgUie2L83YEgcj8Ged5
.threatpost.com/	1970-01-20 00:06:29	Name: __qca Value: P0-1073955254-1608120736887

54 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://info.silobreaker.com/e2t/sc2/MmZ-8ykzpSnW57Ghpr94yfYsW94kVRx5yddnTW1F-Skp6zVkggdBC1BH04(Line 13) Message: toS
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 382) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 407) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 407) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 407) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 407) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: Startup v270 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: uspapi_init() - v0.105
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: USP: Locale=en-us gdpr= false
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gAMPidentityLinkID not present, prebid configured without identyLink
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: GVL version is 45 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=useractioncomplete tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=useractioncomplete
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): amazonBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: geo IP found region Occitanie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: USP does not apply to Occitanie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: Setting not applicable signal
console-api	info	URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs(Line 9) Message: Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI
console-api	info	URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs(Line 9) Message: Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/ransomware-ip-theft-top-covid-19-healthcare-security-scares/162247/?_hsmi=88974744&_hsenc=p2ANqtz-_dnAsWvZgirwAYYDofgbZtoU2B5dUP_WWonojhYQe5TwlLoJg2FV5ANi3LbVxIO9wm3Cdeur5YLICrphRXDpGjj6l2PM8AZAGvEm7NrhsqP6w0GzI

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acdn.adnxs.com
ad313c47c975dc9b795684fdc862df28.safeframe.googlesyndication.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
ap.lijit.com
assets.threatpost.com
c.amazon-adsystem.com
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cm.g.doubleclick.net
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
geo.ipify.org
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
img.connatix.com
info.silobreaker.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
media.threatpost.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.advertising.com
pixel.quantserve.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tag.1rx.io
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
www.youtube.com
104.108.144.214
104.108.145.8
104.111.215.135
104.244.42.3
104.244.42.5
134.209.131.220
136.144.59.88
151.101.13.108
151.101.14.49
151.101.194.137
167.172.1.14
172.217.21.226
18.156.0.31
18.192.150.244
18.196.13.179
18.218.223.45
184.24.15.122
185.33.221.13
185.64.189.112
199.232.52.157
199.232.53.140
199.60.103.254
2.18.234.21
205.185.216.10
213.19.147.210
216.52.2.48
2600:9000:2057:8400:2:9275:3d40:93a1
2600:9000:2127:c000:6:44e3:f8c0:93a1
2600:9000:214f:2800:0:5c46:4f40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e0::ac40:621c
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:bdf::13
2a00:1450:4001:808::2001
2a00:1450:4001:808::2008
2a00:1450:4001:814::2004
2a00:1450:4001:815::2002
2a00:1450:4001:817::2003
2a00:1450:4001:818::200e
2a00:1450:4001:81d::2001
2a00:1450:4001:81f::2001
2a00:1450:4001:81f::2003
2a00:1450:4001:820::200e
2a00:1450:400c:c0c::9a
2a03:2880:f01c:800e:face:b00c:0:2
3.123.45.128
34.255.243.34
35.173.160.135
35.244.159.8
52.210.128.165
52.28.254.214
64.140.160.2
65.9.86.127
65.9.96.62
69.173.144.141
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
07a3eb8be1687dc1ee377d85bffd51891d0fd539258b63ab4031b012bd77f5fc
09ed42fd78450e67d460350fa19015c2df2692b002941add1bef52e5b8af8b62
0ced2f69c8187c7d57855114c9539b24cde31b0454d1ceffe7f3f7131cc16523
14f2cbb5db9c090f3869165c6d45d832483297273c75940921d7a056c0dabff2
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
17c510338e5643237d26026172aec9af3088ab7444f183bb309e9ceec8557af8
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1af71dc28e3d3ca8510776da51cd07996148df0f58601a0bd28d5583b6801a41
1d5ce6abfc56177b773caf44c619827632b66db724318425c0bcbe27066ab06b
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
23b2ce7e8ca6a498b504276ba50bae356859abbda43f9682d1d7e516fe904a16
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2ee2a754bfa8192f848668f19b25a93d77da502d3f311893f8fb7550c9ed7ba4
2f151eb5e281a98c051cb30101eb1beab16d67b2b96733d1f97c03aa669b96f9
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
3477ff569941363c5b777f2fb7f264a60b975bfba13297258a4b4b8413f0f2a7
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
39eba381af6c8ff003ce267900866864e5a90752fe7d343d32b0ae20a21fa2b7
3a1a3b9f64e377ef65125f330e02aa65392c5c112ce8082f096c0070899b63da
3da0404e916206ff343d9b0c419c66e83f5d0821504887d48f3a176c05b2a99e
3e53947da478f53ccea775eb5354a0b5d39e576c91d0b99975ff6c7408ecb1d8
3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1
3fa95dd8157b6539ad198e5a2563cbae65c444b13634acf8879d1330d5cb35d2
41db58474cfc6b16f6dba3f773163a7ecd2ef561269f0f248335cb43bc4848c8
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42a28e8bcde265c93b74fa93f7928ee58a735be5b1efb9b9682e3a61aca9ce13
437afd9de21717c919be3f40f686b33170f2447dc03ded0fc00ac0cc41839854
44673469cc0d56cbaa555124625e9fc20f4ecccabde3e19767e36bb23c003efb
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb
494749353b8e05ac746d7d6cfba920dab49572fa0964c032c86a27163acfed72
4b843501135b1da9cf37b6ac228b459b11996d7a269adeb999ca4860dbe65b7f
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
5087676d610ad3975573f4db9dd354a9f33e77f42f9bea48ce90ee07b242d019
52e9f353d2948f63c91ec1c5535870823f3d7baba88adc47f37e21737b5911c3
540574a1fd48565e8f1f9832d7e32b6894a24e733b7ecc59cf0985c98cbf7f99
58f97b53045d4b853f7dab98bf25aaf6dfcf165e755d9ce03b585c53089f9aed
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8
5ca88677a001e263cc38ed080f5e6534769ae910047eaa45324008ab8a9ba4c9
5cd516aa5e44d31a803ee416ba5fd13e5e33b66bc6c909a05875cbd622a75f44
5d0e7d0bd8b4693b10239e9be46c2c8d5cfc6053c41dd8775abee4a305b2ce53
5d402b74eb1279acb6d73065224e41f2a489e40632be49b4e2333e3f0e778908
5f02981bfcab6807a15ddfea1babc7cee05cd0f1f59abe712928de44fb6c1f0d
631c6a3617e2f5860eaa62155f5200b6ca156c00438445f9862089ef785e4542
63ab49600e3575c38059a86f6105ef2454f6c12d0e8c8e486f2700e4f834ec6e
63d79a5b76b4bef8bb9cd4b451bb60b4a2d277e3b4664d26eac47cb8527fbe02
666652b748f9a7861810bb52c2cbf5cf657c33e6ec53afd028455f6f6b7d3124
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
678c16283762d2d1a12c9b055cf3e4333ca3c4c6638a95741f1130084882756f
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
70c12ab3bce8a60d010804548e22540ea9a000400f9c7266c6eb18313714d347
70cf9dde06143684f8787341cd08282b68b3d5eedd4588b1d6f04b3de5074b7e
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab
75b04f3f04c19903fc665d411ce93bc7282bbba6acb47e7af3281c75e3d967a5
7d0a0574ca4779d98a9bf59afb6136251b0d63c43f5536a239c04b4c2f6f7f45
7f9f3bccb662840153703ccd7651000c02fe3825cd28ddac5b00f93f5fef26bd
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83b61bb90a331478d5e78e1e6f6d9a91f808b4ce2fc6624364acd52bd6307e21
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
85e923c996c5743f3d79cd633c520a4709ecbaef8441def15e92e952db3d54bc
8c3e40d93030ddeac2c5a16a0d1de5e8573c7f018e421582354930fc36846fab
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
9101fe1d604c3876d71e0a5f60f2d368a597e4d477c6462b5ee49647eb790c5b
91c9225038a7e709c9356ec384dc133c3031859517d19e6962d1f1347f6b715e
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a5df491d38bad7be4712ad0e6c636de9212027d2b0fbb433eebda0c2f3182ca2
a758c75dd51e9e53aacd10a22ac8ae2beae57fc0bd9d4297ce2b21106bdd5f5e
a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
afc70f0ed7e054454fa639e9bdd7f5de52543f36fffc3421dddcf12403334821
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b0c292b76ddcfdff8f2343afbb1bfaec2b017b7b5b590766c15aad8aa92cf8c5
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094
b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42
bbb61adef560ac5da24d811a2d8f690935e11454438137262ec4b68c9a14f6c7
bc0e5f55b7d45fbfd0679f2176ac224331a7771a02e426574d13cdd71dbbd470
bedcbc82d42e7e12bb8575c395e83caede7352387eea33b1984be7e736b65aff
c1c9310eb6a56101c2133db372cfbe9cefb5ff6b90a02ded916984c975b813b2
c300b2811698bc68ed2928ff2686ed40e21753f1d308956268f567ab2149e576
c90bbd20e641ee6df4970ba4c2baaa66980c50966573ea66cfbca91584d9cc69
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb2b06b14c047c2794ee42fb17fc63548df57a7f157a59cbd5dc0a7dfa145e7d
d24af29ede48d566c6450a21f6cbb2ec8a7e2a50213d8b28514c38080c7eafee
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d88242d6bd1a8281c9f6162bfd0a9e9834021019cf692e20bf60b880d0f62b49
db27bc97b116f44f9a3341a377e9a1d03348afb85f3582f142234b79484ea3a3
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
dd84e4f7d8c6e9538619f41cb37c903f67ce16f68f59e7fe19af8176ced12645
dde5dcb02f349d5cd1f36d6afe709ddfd5713b27129dbae727f456cde6582883
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e073a12d691638f65d1db0f997ddd70bb2c8666198eee42f9c8c33d7a449f602
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f077a8bc08be05afb0b40eae289d6d5fe83372d1feb60a13b46aae5b8660e76d
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f7387ff2ceb2b6e8160b2782e478b7fb6d935de90ef55867f75d246174df7a85
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f792fc4642c5120f96b4f11b6899eb9e8c6b286e5f6dc8be0015ff7b46223bca
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
f8f96b0cc81405b2a95c412dbf43aebae111f11e98ad743b8fff74b2d5c793a2
fc3de78f8df37d9c0715cdc8fa2de817666f3774bc1a095de5259b86e8a23d2b
fe5d97969e5d98e03eaacc671edb2e30373f05070f5a37d69f5a5f6f91b79149

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

236 Requests

100 %HTTPS

36 %IPv6

44 Domains

69 Subdomains

54 IPs

8 Countries

3846 kBTransfer

8425 kBSize

4 Cookies

14 Outgoing links

Page URL History

Redirected requests

236 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

236
Requests

100 %
HTTPS

36 %
IPv6

44
Domains

69
Subdomains

54
IPs

8
Countries

3846 kB
Transfer

8425 kB
Size

4
Cookies

236 HTTP transactions
4 data transactions