news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/jkowYnpZKM Page URL
2. https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=154277028&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&utmhid=76441866&utmr=https%3A%2F%2Ft.co%2F&utmp=%2Fcorpblog%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&utmht=1630678749077&utmac=UA-737537-1&utmcc=__utma%3D1.1696940499.1630678749.1630678749.1630678749.1%3B%2B__utmz%3D1.1630678749.1.1.utmcsr%3Dt.co%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=1548532330&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1696940499.1630678749&jid=1548532330&_v=5.7.2dc&z=154277028 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1696940499.1630678749&jid=1548532330&_v=5.7.2dc&z=154277028&slf_rd=1&random=4219201825

Request Chain 38

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1630678749096%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F09%252F03%252Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&liSync=true&e_ipv6=AQKNiI2pqSKFwwAAAXusBxHG-c_mX_PXl3W9ADrQQRxhzU28agqt7tBt79kM_OJWSPJCV_M9

Request Chain 48

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AABA407CZF4AACDwaI2IcA HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABA407CZF4AACDwaI2IcA&verifyHash=fe6015b4b2164c8ec8499fbcd74007e97d43ef0d

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	jkowYnpZKM t.co/	496 B 565 B	193ms 145ms	Document text/html	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /jkowYnpZKM pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT vary Origin server tsa_o expires Fri, 03 Sep 2021 14:24:08 GMT set-cookie muc=04b841c0-8366-44a1-ae5e-e910e66ccb4c; Max-Age=63072000; Expires=Sun, 03 Sep 2023 14:19:08 GMT; Domain=t.co; Secure; SameSite=None content-type text/html; charset=utf-8 cache-control private,max-age=300 content-length 251 content-encoding gzip x-xss-protection 0 strict-transport-security max-age=0 x-connection-hash 5bae05d9aa5aa3f206a0530687490df6e7cab11f427886dc169508def57374af
GET H2	200	Primary Request / Show response news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/	73 KB 23 KB	25ms 5ms	Document text/html	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / WordPress VIP <https://wpvip.com> Resource Hash 5ca111362ea67a9e1c307cfafbb89eab2fda232ef53218043849ce6cb3cd5131 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority news.sophos.com :scheme https :path /en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Referer https://t.co/ Response headers server nginx date Fri, 03 Sep 2021 14:19:08 GMT content-type text/html; charset=UTF-8 content-length 22776 x-hacker If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header. x-powered-by WordPress VIP <https://wpvip.com> host-header a9130478a60e5f9135f765b23f26593b link <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/78035>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=78035>; rel=shortlink content-encoding gzip x-rq hhn2 0 2 9980 cache-control max-age=300, must-revalidate age 162 x-cache hit vary Accept-Encoding accept-ranges bytes strict-transport-security max-age=31536000
GET H2	200	/ news.sophos.com/_static/	233 KB 39 KB	6ms 5ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 3e5b1810e546aefebd1e8a5fbcaf01a65c55ebbb4085cb2ef2481e59164f0e15 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip x-rq hhn2 0 2 9980 last-modified Wed, 01 Sep 2021 15:38:52 GMT server nginx age 166963 vary Accept-Encoding x-cache hit content-type text/css;charset=utf-8 cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 40088
GET H2	200	/ Show response news.sophos.com/_static/	98 KB 34 KB	8ms 8ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZkaWhiamZgXkWAK94IiE= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZkaWhiamZgXkWAK94IiE= pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip x-rq hhn2 0 2 9980 last-modified Mon, 16 Aug 2021 20:26:47 GMT server nginx age 167341 vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 34533
GET H2	200	Category-Icon-Security-Operations@2x_r2.min_.png news.sophos.com/wp-content/uploads/2021/06/	41 KB 41 KB	8ms 6ms	Image image/png	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/06/Category-Icon-Security-Operations@2x_r2.min_.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b276efdcd262ee443ffb432b953eb94c8ae1e1624eee5f3409da02a48c5b768c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/06/Category-Icon-Security-Operations@2x_r2.min_.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 88 443 last-modified Fri, 18 Jun 2021 15:00:03 GMT server nginx etag "3ae8b12b08d2fded" strict-transport-security max-age=31536000 x-cache HIT content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 41607 expires Wed, 24 Aug 2022 16:42:58 GMT
GET H2	200	sean-gallagher.jpg news.sophos.com/wp-content/uploads/2020/02/	16 KB 16 KB	8ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/02/sean-gallagher.jpg?w=400 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 55eaca0d345f2747157c721e6bf4ae70dd3777649dc627738055d80ac763b3dc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2020/02/sean-gallagher.jpg?w=400 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 142 443 last-modified Tue, 24 Aug 2021 15:35:54 GMT server nginx etag "080e7252ce82458f" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 16552 expires Wed, 24 Aug 2022 15:35:54 GMT
GET H2	200	Peter-Mackenzie.jpg news.sophos.com/wp-content/uploads/2019/09/	4 KB 5 KB	8ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2019/09/Peter-Mackenzie.jpg?w=200 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bf46dd7258de2cf2dc0ffe34aeeb6381fe95edc2f4abe0cae7f58aa14f8ab01c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2019/09/Peter-Mackenzie.jpg?w=200 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 28 443 last-modified Tue, 24 Aug 2021 18:18:15 GMT server nginx etag "aec08b13a9190191" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4586 expires Wed, 24 Aug 2022 18:18:15 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	107 KB 41 KB	24ms 22ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 70161f3ce18da58c240097eaba56448ca67a193873d31e6b6b3c6c9eced7728c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding br vary * cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42178 x-xss-protection 0 pragma no-cache server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	wp-emoji-release.min.js Show response news.sophos.com/wp-includes/js/	18 KB 5 KB	8ms 7ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-includes/js/wp-emoji-release.min.js?ver=5.8 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip x-rq hhn2 0 2 9980 last-modified Mon, 16 Aug 2021 20:26:47 GMT server nginx age 856249 etag W/"611aca07-4705" vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4998 expires Sat, 03 Sep 2022 14:19:08 GMT
GET H2	200	/ Show response news.sophos.com/_static/	135 KB 38 KB	6ms 5ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyVjEsOwyAMBS9UbCBqsqp6FoSsBFI+wm7T45cqFwjSW41mHh5V+ZKFsqBslIiRS90KZzpYWW0WjNzXpbIHUh8LFkwHcAKIfMNLH760AZu+0hxf908Ebwmv8cq7VF1Y83BYXZNMbbhb3XDyZz16poeZJ303epls/AGgTaA0 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /_static/??-eJyVjEsOwyAMBS9UbCBqsqp6FoSsBFI+wm7T45cqFwjSW41mHh5V+ZKFsqBslIiRS90KZzpYWW0WjNzXpbIHUh8LFkwHcAKIfMNLH760AZu+0hxf908Ebwmv8cq7VF1Y83BYXZNMbbhb3XDyZz16poeZJ303epls/AGgTaA0 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip x-rq hhn2 0 2 9980 last-modified Wed, 01 Sep 2021 15:38:52 GMT server nginx age 166957 vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 39329
GET H2	200	alpine.min.js Show response cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/	26 KB 9 KB	8ms 6ms	Script application/javascript	2a04:4e42:3::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/alpine.min.js?ver=2.0.1 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 5576115 x-jsd-version 2.8.1 x-cache HIT cross-origin-resource-policy cross-origin content-length 8686 etag W/"6964-M33llwtEtRbUwMPPG0SKpWL3vX8" x-served-by cache-fra19135-FRA x-jsd-version-type version date Fri, 03 Sep 2021 14:19:08 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	/ Show response news.sophos.com/_static/	5 KB 2 KB	7ms 5ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??/wp-includes/js/comment-reply.min.js,/wp-includes/js/wp-embed.min.js,/wp-content/mu-plugins/akismet/_inc/form.js?m=1629812661j Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 068b1a66d253cba54a9aa5dcd532fce67d168918e90d351a4140cf01dd63b380 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /_static/??/wp-includes/js/comment-reply.min.js,/wp-includes/js/wp-embed.min.js,/wp-content/mu-plugins/akismet/_inc/form.js?m=1629812661j pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip x-rq hhn2 0 2 9980 last-modified Tue, 24 Aug 2021 13:44:21 GMT server nginx age 103124 vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 2155
GET H2	200	e-202135.js Show response stats.wp.com/	9 KB 3 KB	66ms 22ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202135.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers x-nc HIT ams date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip server nginx etag W/"5c6340e3-350a" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 expires Sun, 21 Aug 2022 22:14:17 GMT
GET H2	200	sophos-ransomware-web-banner-1200x628px-option-2.png news.sophos.com/wp-content/uploads/2021/05/	75 KB 75 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 632adbe6ad11ec159079391311ff0ad317ad1c52890365dbfeb497fedabfaebb Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png?w=640 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 139 443 last-modified Mon, 24 May 2021 13:39:33 GMT server nginx etag "7f53a7c1e14cb577" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 76514 expires Tue, 24 May 2022 13:39:33 GMT
GET H2	200	sophos-edr-news-blog-image-838x440px@2x.png news.sophos.com/wp-content/uploads/2021/05/	11 KB 11 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/sophos-edr-news-blog-image-838x440px@2x.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bd83358a15f76cc031ddf566a6cc1e16f8a86570aeea439bfb3a51bea4786970 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/05/sophos-edr-news-blog-image-838x440px@2x.png?w=640 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 30 443 last-modified Wed, 19 May 2021 13:35:03 GMT server nginx etag "bcaea0353ad286e0" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 11188 expires Thu, 19 May 2022 13:35:03 GMT
GET H2	200	sophos-xdr.png news.sophos.com/wp-content/uploads/2021/05/	39 KB 39 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/sophos-xdr.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d60b73d55aed17b7121e54d535602c04a3dce36a90ce83ce95c60a3995838334 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/05/sophos-xdr.png?w=640 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 140 443 last-modified Fri, 07 May 2021 09:25:21 GMT server nginx etag "75f40308425a625b" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 39726 expires Sat, 07 May 2022 09:25:21 GMT
GET H2	200	SophosSans-Light.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	25 KB 25 KB	105ms 104ms	Font font/woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2 pragma no-cache origin https://news.sophos.com accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority news.sophos.com referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= :scheme https sec-fetch-site same-origin :method GET Origin https://news.sophos.com Referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT vary X-Mobile-Class, Accept-Encoding age 0 x-cache miss content-length 25316 x-rq hhn2 0 2 9980 last-modified Wed, 01 Sep 2021 15:38:52 GMT server nginx etag "612f9e8c-62e4" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 03 Sep 2022 14:19:08 GMT
GET H2	200	SophosSans-Medium.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	101ms 101ms	Font font/woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2 pragma no-cache origin https://news.sophos.com accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority news.sophos.com referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= :scheme https sec-fetch-site same-origin :method GET Origin https://news.sophos.com Referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT vary X-Mobile-Class, Accept-Encoding age 0 x-cache miss content-length 26532 x-rq hhn2 0 2 9980 last-modified Wed, 01 Sep 2021 15:38:52 GMT server nginx etag "612f9e8c-67a4" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 03 Sep 2022 14:19:08 GMT
GET H2	200	SophosSans-Semibold.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	100ms 100ms	Font font/woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2 pragma no-cache origin https://news.sophos.com accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority news.sophos.com referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= :scheme https sec-fetch-site same-origin :method GET Origin https://news.sophos.com Referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/U4ATUsqp6lhAsSOt8hBOh3J7QdgHqpjuPZ57sgTUK6w3lERkMM4yWEwwUzEuQHRa9FOBUCBtnfVMDFzgSTwaHo9VI6NCnk4ikCy6CcNKm/IdX76hPkAk+7Zk0V4+BQ5wDe1xZtFL1nyfr2KofwmURKU/W14OYoq7VlGzku+53sTMPd1e3Tl6V7Lt2A56XZas= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT vary X-Mobile-Class, Accept-Encoding age 0 x-cache miss content-length 26664 x-rq hhn2 0 2 9980 last-modified Wed, 01 Sep 2021 15:38:52 GMT server nginx etag "612f9e8c-6828" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 03 Sep 2022 14:19:08 GMT
GET H2	200	contishell-1.jpg news.sophos.com/wp-content/uploads/2021/09/	154 KB 154 KB	7ms 5ms	Image image/jpeg	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/09/contishell-1.jpg Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5de1941483bd29992f17c37717fbd7f3554e4801247e4e80cf2ef0125fae5316 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/09/contishell-1.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 140 443 last-modified Thu, 02 Sep 2021 00:06:40 GMT server nginx etag "858c814400aa066a" strict-transport-security max-age=31536000 x-cache HIT content-type image/jpeg cache-control max-age=2592000 accept-ranges bytes content-length 157510 expires Sat, 03 Sep 2022 12:48:11 GMT
GET H2	200	conti-proxyshell_cmdlet-1.png news.sophos.com/wp-content/uploads/2021/09/	22 KB 22 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/09/conti-proxyshell_cmdlet-1.png?resize=768,148 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash efe76618a6283f2c8a959c4c9e680c7102d792ec4f818147a0c4f897c3d5a39a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/09/conti-proxyshell_cmdlet-1.png?resize=768,148 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 139 443 last-modified Fri, 03 Sep 2021 13:01:22 GMT server nginx etag "fc3f9f1a1cfcd50f" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 22202 expires Sat, 03 Sep 2022 13:01:22 GMT
GET H2	200	conti-proxyshell_cmdlet2.png news.sophos.com/wp-content/uploads/2021/09/	21 KB 21 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/09/conti-proxyshell_cmdlet2.png?resize=768,152 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f2d7cb550d69d56f0be728fa2dbe54bfe6179593314bbd858428a62b319f0eed Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/09/conti-proxyshell_cmdlet2.png?resize=768,152 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 139 443 last-modified Fri, 03 Sep 2021 13:01:22 GMT server nginx etag "4531e1178c23e315" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 21194 expires Sat, 03 Sep 2022 13:01:22 GMT
GET H2	200	conti-proxyshell_cmdlet3.png news.sophos.com/wp-content/uploads/2021/09/	24 KB 24 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/09/conti-proxyshell_cmdlet3.png?resize=768,149 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a9ad76f46af6c33c9a809d19ebfe9a743a437217f3c2c19fc7d7083674b7e766 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/09/conti-proxyshell_cmdlet3.png?resize=768,149 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 198 443 last-modified Fri, 03 Sep 2021 13:01:23 GMT server nginx etag "b39cc0b5443977ac" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 24138 expires Sat, 03 Sep 2022 13:01:23 GMT
GET H2	200	evilcorp.jpg news.sophos.com/wp-content/uploads/2021/09/	327 KB 327 KB	8ms 7ms	Image image/jpeg	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/09/evilcorp.jpg Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash db69868b71ea6e03c6e2eb39fe1fda731b9ea601269dd08d9be3fe86a54fb76b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :path /wp-content/uploads/2021/09/evilcorp.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority news.sophos.com referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ :scheme https sec-fetch-site same-origin :method GET Referer https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT x-rq hhn2 109 28 443 last-modified Thu, 02 Sep 2021 14:49:03 GMT server nginx etag "56a1f0048ca0acb9" strict-transport-security max-age=31536000 x-cache HIT content-type image/jpeg cache-control max-age=2592000 accept-ranges bytes content-length 334664 expires Sat, 03 Sep 2022 12:48:46 GMT
GET H2	200	dc.js Show response stats.g.doubleclick.net/	45 KB 17 KB	40ms 14ms	Script text/javascript	2a00:1450:400c:c08::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/dc.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVjEsOwyAMBS9UbCBqsqp6FoSsBFI+wm7T45cqFwjSW41mHh5V+ZKFsqBslIiRS90KZzpYWW0WjNzXpbIHUh8LFkwHcAKIfMNLH760AZu+0hxf908Ebwmv8cq7VF1Y83BYXZNMbbhb3XDyZz16poeZJ303epls/AGgTaA0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 11 Aug 2021 00:32:57 GMT server Golfe2 age 1550 date Fri, 03 Sep 2021 13:53:19 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17093 expires Fri, 03 Sep 2021 15:53:19 GMT
GET H/1.1	200 OK	elqCfg.min.js Show response img03.en25.com/i/	6 KB 3 KB	94ms 35ms	Script application/x-javascript	104.111.229.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img03.en25.com/i/elqCfg.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVjEsOwyAMBS9UbCBqsqp6FoSsBFI+wm7T45cqFwjSW41mHh5V+ZKFsqBslIiRS90KZzpYWW0WjNzXpbIHUh8LFkwHcAKIfMNLH760AZu+0hxf908Ebwmv8cq7VF1Y83BYXZNMbbhb3XDyZz16poeZJ303epls/AGgTaA0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.229.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-229-66.deploy.static.akamaitechnologies.com Software / Resource Hash 3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 2183 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Tue, 17 Aug 2021 17:49:31 GMT Date Fri, 03 Sep 2021 14:19:09 GMT Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store ETag "fac3963b9093d71:0" Accept-Ranges bytes X-Robots-Tag noindex, nofollow Expires Fri, 03 Sep 2021 14:19:09 GMT
GET H2	200	g.gif pixel.wp.com/	50 B 92 B	23ms 22ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&j=1%3A10.0&blog=166161023&post=78035&tz=-4&srv=news.sophos.com&host=news.sophos.com&ref=https%3A%2F%2Ft.co%2F&fcp=0&rand=0.39800539268438984 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H3-29	200	js Show response www.googletagmanager.com/gtag/	96 KB 38 KB	33ms 30ms	Script application/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-743773256 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7c86be9bc6e3748483477cf752afd53a1b5fae97dc9b0004786ccc123124a2fe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39220 x-xss-protection 0 last-modified Fri, 03 Sep 2021 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 03 Sep 2021 14:19:09 GMT
GET H2	200	bat.js Show response bat.bing.com/	30 KB 9 KB	66ms 29ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:08 GMT content-encoding gzip last-modified Wed, 28 Jul 2021 18:27:37 GMT x-msedge-ref Ref A: 4C2314C47F52494391EC895330BB305B Ref B: FRAEDGE1417 Ref C: 2021-09-03T14:19:09Z etag "80f2963dde83d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 9024
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	99 KB 26 KB	23ms 8ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 25999 x-xss-protection 0 pragma public x-fb-debug m3LwjoUfmiYc6/Afmo5mVSvMaL/tozs2Wfqn6UHmE1cZyOors1jhkZNGtMaPd7wWNl/SMXxB5UinmcBiqDB9xA== x-fb-trip-id 917726464 cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Fri, 03 Sep 2021 14:19:09 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	5 KB 2 KB	22ms 7ms	Script application/x-javascript	2a02:26f0:6c00:296::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:296::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Fri, 03 Sep 2021 14:19:09 GMT Content-Encoding gzip Last-Modified Fri, 13 Aug 2021 21:34:05 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=62344 Connection keep-alive Accept-Ranges bytes Content-Length 2036
GET H2	200	WuEFNglz.min.js Show response scripts.demandbase.com/	61 KB 16 KB	120ms 26ms	Script application/javascript	18.66.112.89 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/WuEFNglz.min.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.89 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers x-amz-version-id LCueR8U3D7lJgwCfemj1Slg2LluSXKrc content-encoding gzip last-modified Thu, 17 Jun 2021 19:46:43 GMT server AmazonS3 age 972 etag W/"b068f44152e87ccb66f40491a735aad0" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 edffe6978db53d114a80cda421e0b6b9.cloudfront.net (CloudFront) cache-control public, max-age=3600 date Fri, 03 Sep 2021 14:03:02 GMT x-amz-cf-pop FRA56-P5 x-amz-cf-id KQJmZffK-v_9IAkQXBIMFfMIckFNpC1ZxVBdwWpPazS6i9ek2fJEwQ==
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	81ms 22ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT via 1.1 varnish last-modified Mon, 12 Jul 2021 23:59:25 GMT age 54027 etag "65cf0c0ceb852397f0d1e6732cd3c533+gzip" vary Accept-Encoding,Host x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-encoding gzip cache-control no-cache accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 1958 x-timer S1630678749.099601,VS0,VE0 x-served-by cache-fra19127-FRA
GET H2	200	qevents.js Show response a.quora.com/	39 KB 14 KB	84ms 32ms	Script text/plain	151.101.13.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://a.quora.com/qevents.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers x-amz-version-id s3LlaOWABX1LUjiLldBNr49lVAylKDRo content-encoding gzip etag "f32ebb1e93a72c0a57add6d07f688510" age 2647 x-cache HIT, HIT content-length 13681 x-amz-id-2 LPqU6a7EuNiiQTiqONvV05BHRbU8VySTIEl5fFs/P5A8SUwQxRjoZDgdkRl7+LjzJA+BjwCwsMA= x-served-by cache-bwi5157-BWI, cache-fra19171-FRA last-modified Fri, 25 Oct 2019 19:28:38 GMT server AmazonS3 x-amz-meta-s3cmd-attrs atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou x-timer S1630678749.099714,VS0,VE0 date Fri, 03 Sep 2021 14:19:09 GMT vary Accept-Encoding x-amz-request-id CG3F0MGTVSY7Y9B9 via 1.1 varnish, 1.1 varnish cache-control max-age=7200 accept-ranges bytes content-type text/plain x-cache-hits 1, 288
GET H/1.1	200 OK	events.js Show response tags.srv.stackadapt.com/	13 KB 5 KB	421ms 111ms	Script text/javascript	54.165.186.74 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/events.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-186-74.compute-1.amazonaws.com Software / Resource Hash a75d32c0d38c66cf9c2c5013eeab09036cee07ce4f9f660c117cc43e93a326b0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 03 Sep 2021 14:19:09 GMT Content-Encoding gzip Cache-Control max-age=30 Content-Length 4440 Connection keep-alive Content-Type text/javascript
GET H/1.1	200 OK	up_loader.1.1.0.js Show response js.adsrvr.org/	4 KB 2 KB	71ms 21ms	Script application/x-javascript	18.66.96.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/up_loader.1.1.0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.66.96.113 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Fri, 03 Sep 2021 14:18:25 GMT Content-Encoding gzip Last-Modified Thu, 24 Sep 2020 15:15:34 GMT Server AmazonS3 Age 45 ETag W/"98d98b3499058b76d58073cf8ede2f10" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/x-javascript Via 1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA56-P2 X-Amz-Cf-Id NR2bQl6DM2iSAsEBfeDivZLwreWSG5n-OiopY8lu6f-QGmxlBUzb8w==
GET H2	200	ytc.js Show response s.yimg.com/wi/	15 KB 6 KB	39ms 6ms	Script application/javascript	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/ytc.js Requested by Host: t.co URL: https://t.co/jkowYnpZKM Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers ats-carp-promotion 1 date Fri, 03 Sep 2021 13:54:30 GMT content-encoding gzip x-content-type-options nosniff age 1480 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 5639 x-amz-id-2 E6FV29xAJ6iRlIEIZWH6CB9hQU2Pq+TKsd/3DDnpMwTlcJkXrUlJAJoTOnDseOSyoqvlvnI10Gg= referrer-policy no-referrer-when-downgrade x-amz-expiration expiry-date="Sat, 02 Jul 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle" last-modified Thu, 27 May 2021 13:00:20 GMT server ATS etag "6de43f1c725d89777edaa2bc5d679ecb-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id HBFKKMZ5JJP3Q1AX x-xss-protection 1; mode=block cache-control public,max-age=3600 x-amz-version-id Bv0RNzsjZsSn6kGrZjdvdggYqc20u__d accept-ranges bytes content-type application/javascript
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=154277028&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=2... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1696940499.1630678749&jid=1548532330&_v=5.7.2dc&z=154277028 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1696940499.1630678749&jid=1548532330&_v=5.7.2dc&z=154277028&slf_rd=1&random=4219201825	42 B 522 B	50ms 30ms	Image image/gif	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1696940499.1630678749&jid=1548532330&_v=5.7.2dc&z=154277028&slf_rd=1&random=4219201825 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers pragma no-cache date Fri, 03 Sep 2021 14:19:09 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Fri, 03 Sep 2021 14:19:09 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1696940499.1630678749&jid=1548532330&_v=5.7.2dc&z=154277028&slf_rd=1&random=4219201825 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	__utm.gif stats.g.doubleclick.net/r/	35 B 55 B	29ms 15ms	Image image/gif	2a00:1450:400c:c08::9d GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=753119475&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&utmhid=76441866&utmr=https%3A%2F%2Ft.co%2F&utmp=%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&utmht=1630678749088&utmac=UA-737537-53&utmcc=__utma%3D204943247.603355080.1630678749.1630678749.1630678749.1%3B%2B__utmz%3D204943247.1630678749.1.1.utmcsr%3Dt.co%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=2019647416&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Fri, 03 Sep 2021 14:19:09 GMT content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomw... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1630678749096%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomw... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransom...	0 156 B	321ms 119ms	Image application/javascript	108.174.10.14 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&liSync=true&e_ipv6=AQKNiI2pqSKFwwAAAXusBxHG-c_mX_PXl3W9ADrQQRxhzU28agqt7tBt79kM_OJWSPJCV_M9 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.174.10.14 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-10-14.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 x-li-proto http/2 x-li-pop prod-edc2 content-type application/javascript content-length 0 x-li-uuid aDCb8K5VoRZQTk5R7CoAAA== Redirect headers date Fri, 03 Sep 2021 14:19:09 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1630678749096&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&liSync=true&e_ipv6=AQKNiI2pqSKFwwAAAXusBxHG-c_mX_PXl3W9ADrQQRxhzU28agqt7tBt79kM_OJWSPJCV_M9 x-li-proto http/2 x-li-pop prod-edc2 content-length 0 x-li-uuid qcKe3a5VoRYQyY6Q0ioAAA==
GET H2	200	10150886.json Show response s.yimg.com/wi/config/	2 B 494 B	117ms 103ms	XHR application/json	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/config/10150886.json Requested by Host: s.yimg.com URL: https://s.yimg.com/wi/ytc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT content-encoding gzip x-content-type-options nosniff age 0 vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding x-amz-request-id EMTAAYGBD1P98J4D x-amz-id-2 ODJRhhHWpfa7LWwibCWbTLZM3fubc46uAhi6WaGNStcoHiMmbyqtdsifgpzXBbRxiwLLWDTSTjA= referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 access-control-allow-methods GET content-type application/json access-control-allow-origin * x-xss-protection 1; mode=block cache-control public,max-age=3600 content-length 22
GET H3-29	200	334990480506518 Show response connect.facebook.net/signals/config/	306 KB 87 KB	10ms 10ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/334990480506518?v=2.9.45&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b06995c16ddb8a51f17eac325487bd530b9abba0ae814fc20b47f171ce97b57a Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 89263 x-xss-protection 0 pragma public x-fb-debug GRkQ8Rvii49pHU6hFiZ3CAFFBwafMbFPFSxY/FaiwOMfyrCCb8vWTyHVcri+3jIvg9WBnpJXKkCerwUxZ6ZZ1Q== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Fri, 03 Sep 2021 14:19:09 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	36 KB 14 KB	98ms 43ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash a53b289843b15d58a9574645ea05db23c5dd6663fc5e39f5c61528ae13de22f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14079 x-xss-protection 0 server cafe etag 18326714422570925345 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 03 Sep 2021 14:19:09 GMT
GET H2	204	4015302.js Show response bat.bing.com/p/action/	0 109 B	31ms 31ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4015302.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers access-control-allow-origin * date Fri, 03 Sep 2021 14:19:08 GMT cache-control private,max-age=86400 x-msedge-ref Ref A: 0856B457EC894BB4871183AF1D57EEBF Ref B: FRAEDGE1417 Ref C: 2021-09-03T14:19:09Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 149 B	43ms 43ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=8443af9a-5bbf-4d04-8f70-b4cae254a8c1&sid=e75a03f00cc111ec9f6ad3053e7e26e9&vid=e75a68c00cc111ec9e87bd86cdd5ae44&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&r=https%3A%2F%2Ft.co%2F&lt=301&evt=pageLoad&msclkid=N&sv=1&rn=52239 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Fri, 03 Sep 2021 14:19:08 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: C77F3168B0D047D7AC93D6C8C4A95954 Ref B: FRAEDGE1417 Ref C: 2021-09-03T14:19:09Z x-cache CONFIG_NOCACHE expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	pixel q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/	43 B 421 B	411ms 105ms	Image image/gif	18.215.205.165 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&tag=ViewContent&ts=1630678749138 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.215.205.165 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-215-205-165.compute-1.amazonaws.com Software nginx / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Fri, 03 Sep 2021 14:19:09 GMT Server nginx Connection keep-alive Content-Length 43 Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Q-Stat ,f7f1489906a00541dc50cfc4a36c6ddf,10.0.0.101,21788,82.102.19.136,,113105406643,1,1630678749.491,0.002,,.,0,0,0.000,0.004,-,0,0,197,96,48,10,26847,,,,,,-, Content-Type image/gif
GET H2	200	adsct t.co/i/	43 B 360 B	129ms 129ms	Image image/gif	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 pragma no-cache last-modified Fri, 03 Sep 2021 14:19:09 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 5bae05d9aa5aa3f206a0530687490df6e7cab11f427886dc169508def57374af x-transaction 44d896204cd39e58 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 297 B	20ms 6ms	Image image/gif	2a03:2880:f12d:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1630678749155&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&fbp=fb.1.1630678749153.830230556&it=1630678749109&coo=false&exp=p0&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 03 Sep 2021 14:19:09 GMT
GET H2	200	ip.json Show response api.company-target.com/api/v2/	435 B 935 B	571ms 307ms	XHR application/json	18.66.97.17 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=https%3A%2F%2Ft.co%2F&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&page_title=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7 Requested by Host: scripts.demandbase.com URL: https://scripts.demandbase.com/WuEFNglz.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.97.17 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d4ea3e72d13f7392cf63396cfad6069a9c80d1b43f2de63b763cfec67d77540c Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT identification-source CENTRAL vary Accept-Encoding, Origin x-amz-cf-pop FRA56-P2 x-cache Miss from cloudfront request-id b21a071a-6aca-4f60-a314-1237c1e1846c content-encoding gzip pragma no-cache access-control-allow-origin https://news.sophos.com server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 bbd2abbdb134a9d53c0a12f6566e69ff.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ozWeyRazqjOin5PmVX0aIIEvVWSnPcNMb8g-FV9j5jLHyitm1wtK8A== expires Thu, 02 Sep 2021 14:19:09 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AABA407CZF4AACDwaI2IcA https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABA407CZF4AACDwaI2IcA&verifyHash=fe6015b4b2164c8ec8499fbcd74007e97d43ef0d	26 B 409 B	116ms 116ms	Image image/gif	13.32.121.120 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABA407CZF4AACDwaI2IcA&verifyHash=fe6015b4b2164c8ec8499fbcd74007e97d43ef0d Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.32.121.120 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-120.fra60.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Fri, 03 Sep 2021 14:19:10 GMT Via 1.1 d954dd318e06aa0e69375f36dcd819de.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P1 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id 1db24bc43dc3ec97 X-Amz-Cf-Id MQNuELMhyHsuoew9S2iB_UKDLuthgZy66hE8R3cFEzPH1P76LPoQEw== Redirect headers Date Fri, 03 Sep 2021 14:19:10 GMT Via 1.1 d954dd318e06aa0e69375f36dcd819de.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P1 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AABA407CZF4AACDwaI2IcA&verifyHash=fe6015b4b2164c8ec8499fbcd74007e97d43ef0d Connection keep-alive trace-id 259b2d7399b8205c Content-Length 0 X-Amz-Cf-Id Wty82sK5WamT49rDu45cTBTMRsSGT_XCsclNwbGjlEI7GF298OrnVQ==
GET H2	451	464526.gif id.rlcdn.com/	0 66 B	939ms 691ms	Image text/plain	35.244.174.68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://id.rlcdn.com/464526.gif Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 68.174.244.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:10 GMT via 1.1 google alt-svc clear content-length 0
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/	3 KB 2 KB	39ms 18ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1630678749236&cv=9&fst=1630678749236&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa910&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&ref=https%3A%2F%2Ft.co%2F&tiba=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 86a3bbdb82f097b3ea4c60ed38f103a1396b1c2f5797551fefde6c226496433a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers pragma no-cache date Fri, 03 Sep 2021 14:19:09 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1135 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	/ www.google.com/pagead/1p-user-list/743773256/	42 B 64 B	32ms 30ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/743773256/?random=1630678749236&cv=9&fst=1630677600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa910&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&ref=https%3A%2F%2Ft.co%2F&tiba=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=905553042&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers pragma no-cache date Fri, 03 Sep 2021 14:19:09 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	/ www.google.de/pagead/1p-user-list/743773256/	42 B 64 B	28ms 26ms	Image image/gif	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/743773256/?random=1630678749236&cv=9&fst=1630677600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa910&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&ref=https%3A%2F%2Ft.co%2F&tiba=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=905553042&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers pragma no-cache date Fri, 03 Sep 2021 14:19:09 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	sa.css tags.srv.stackadapt.com/	82 B 309 B	101ms 101ms	Stylesheet text/css	54.165.186.74 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.css Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-186-74.compute-1.amazonaws.com Software / Resource Hash 6525a302cc28ce5dc560d81f3857c67f6feb18a647a018ab0dd4585d339674bd Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 03 Sep 2021 14:19:09 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 82 Content-Type text/css
GET H/1.1	200 OK	sa.jpeg Show response tags.srv.stackadapt.com/	0 881 B	423ms 105ms	Fetch image/jpeg	54.165.186.74 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.jpeg Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-186-74.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 03 Sep 2021 14:19:09 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 651 Content-Type image/jpeg
GET H3-29	200	/ www.facebook.com/tr/	44 B 91 B	8ms 6ms	Image image/gif	2a03:2880:f12d:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1630678749658&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F%22%2C%22og%3Adescription%22%3A%22An%20investigation%20into%20recent%20attacks%20by%20a%20Conti%20affiliate%20reveals%20that%20that%20the%20attackers%20initially%20accessed%20targeted%20organizations%E2%80%99%20networks%20with%20ProxyShell%2C%20an%20exploit%20of%20vulnerabilities%20in%E2%80%A6%22%2C%22article%3Apublished_time%22%3A%222021-09-03T12%3A30%3A24%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-09-03T12%3A37%3A46%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F09%2Fcontishell-1.jpg%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F09%2Fcontishell-1.jpg%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22427%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.45&r=stable&ec=1&o=30&fbp=fb.1.1630678749153.830230556&it=1630678749109&coo=false&es=automatic&tm=3&exp=p0&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:09 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin content-length 44 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i expires Fri, 03 Sep 2021 14:19:09 GMT
GET H/1.1	200 OK	saq_pxl Show response tags.srv.stackadapt.com/	94 B 397 B	102ms 101ms	XHR text/plain	54.165.186.74 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&t=Conti%20affiliates%20use%20ProxyShell%20Exchange%20exploit%20in%20ransomware%20attacks%20%E2%80%93%20Sophos%20News&host=https://news.sophos.com&sa_conv_data_css_value=%20%220-8bd94700-3536-4f53-6134-9f3d2062e9f4%24ip%2482.102.19.136%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd99fb3e6457b9942db7f9da8ace6694d2552661388 Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-186-74.compute-1.amazonaws.com Software / Resource Hash 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Fri, 03 Sep 2021 14:19:09 GMT Access-Control-Allow-Methods GET Content-Type text/plain; charset=utf-8 Access-Control-Allow-Origin https://news.sophos.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 94
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 656 B	190ms 140ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 14:19:10 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 pragma no-cache last-modified Fri, 03 Sep 2021 14:19:10 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 14d3b10030f5240f12eca0401008e0081b3b2a8a06e2b583ffcdc1951e2417a9 x-transaction 729c75b6bcc6a8e8 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	up Show response insight.adsrvr.org/track/ Frame 727B	0 182 B	109ms 41ms	Document text/html	52.50.64.214 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&upid=ql4fc2b&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.50.64.214 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-50-64-214.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers :method GET :authority insight.adsrvr.org :scheme https :path /track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F09%2F03%2Fconti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks%2F&upid=ql4fc2b&upv=1.1.0 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://news.sophos.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Referer https://news.sophos.com/ Response headers date Fri, 03 Sep 2021 14:19:10 GMT content-type text/html cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"