urlscan.io logo urlscan.io
SecurityTrails logo

www.google.ca Open in urlscan Pro
2a00:1450:401b:801::2003  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://autonomicit.us14.list-manage.com/track/click?u=b3d10b8b1bb82214ea13e07c8&id=c8616e825f&e=23307ecf7c
Effective URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFgh...
Submission: On June 08 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 38 IPs in 5 countries across 22 domains to perform 148 HTTP transactions. The main IP is 2a00:1450:401b:801::2003, located in Ireland and belongs to GOOGLE - Google Inc., US. The main domain is www.google.ca.
TLS certificate: Issued by Google Internet Authority G2 on May 31st 2017. Valid for: 3 months.
This is the only time www.google.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2a00:1450:401... 15169 (GOOGLE)
4 2600:9000:204... 16509 (AMAZON-02)
5 2600:9000:204... 16509 (AMAZON-02)
2 2600:9000:204... 16509 (AMAZON-02)
1 2a00:1450:401... 15169 (GOOGLE)
1 138.108.96.100 16477 (ACNIELSEN-AS)
2 95.100.248.115 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:204... 16509 (AMAZON-02)
9 2600:9000:204... 16509 (AMAZON-02)
1 95.101.248.119 16625 (AKAMAI-AS)
12 2600:9000:201... 16509 (AMAZON-02)
5 2a00:1450:401... 15169 (GOOGLE)
9 216.58.209.66 15169 (GOOGLE)
11 2a00:1450:400... 15169 (GOOGLE)
2 62.67.193.21 26667 (RUBICONPR...)
1 62.67.193.61 26667 (RUBICONPR...)
15 95.101.252.144 16625 (AKAMAI-AS)
10 69.172.216.55 7415 (ADSAFE-1)
3 54.192.48.56 16509 (AMAZON-02)
2 2a03:2880:f01... 32934 (FACEBOOK)
16 69.172.216.111 7415 (ADSAFE-1)
1 216.58.209.70 15169 (GOOGLE)
7 95.100.189.14 16625 (AKAMAI-AS)
1 37.187.148.39 16276 (OVH)
1 62.67.193.85 26667 (RUBICONPR...)
1 54.235.172.139 14618 (AMAZON-AES)
1 62.67.193.23 26667 (RUBICONPR...)
1 2a00:1450:401... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 151.101.12.175 54113 (FASTLY)
1 172.217.22.66 15169 (GOOGLE)
4 107.178.255.114 15169 (GOOGLE)
1 184.73.198.237 14618 (AMAZON-AES)
2 149.202.93.239 16276 (OVH)
2 46.137.181.13 16509 (AMAZON-02)
1 54.88.53.255 14618 (AMAZON-AES)
148 38
2    2a00:1450:401b:801::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.google.ca
4    2600:9000:2041:4a00:f:4ddd:5d80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.wired.co.uk
5    2600:9000:2041:8200:f:4ddd:5d80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.wired.co.uk
2    2600:9000:2041:a400:2:75ac:ea80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
covers.condenast.co.uk
1    2a00:1450:401b:800::2008 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.googletagmanager.com
1    138.108.96.100 (Schaumburg, United States)

ASN16477 (ACNIELSEN-AS - ACNIELSEN, US)
secure-uk.imrworldwide.com
2    95.100.248.115 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-100-248-115.deploy.akamaitechnologies.com
b.scorecardresearch.com
3    2a00:1450:4001:81d::200e (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.google-analytics.com
1    2600:9000:2041:d000:f:4ddd:5d80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.wired.co.uk
9    2600:9000:2041:9e00:f:4ddd:5d80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.wired.co.uk
1    95.101.248.119 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-101-248-119.deploy.akamaitechnologies.com
ads.rubiconproject.com
12    2600:9000:201b:4e00:b:ece0:3340:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
wi-images.condecdn.net
5    2a00:1450:401b:803::2002 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.googletagservices.com
pagead2.googlesyndication.com
9    216.58.209.66 (Mountain View, United States)

ASN15169 (GOOGLE - Google Inc., US)
PTR: waw02s06-in-f66.1e100.net
securepubads.g.doubleclick.net
11    2a00:1450:4001:81d::2001 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
tpc.googlesyndication.com
2    62.67.193.21 (United Kingdom)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
fastlane.rubiconproject.com
1    62.67.193.61 (United Kingdom)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
fastlane.rubiconproject.com
15    95.101.252.144 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-101-252-144.deploy.akamaitechnologies.com
z.moatads.com
px.moatads.com
10    69.172.216.55 (New York, United States)

ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US)
pixel.adsafeprotected.com
3    54.192.48.56 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-48-56.jfk5.r.cloudfront.net
cdn.adsafeprotected.com
2    2a03:2880:f01c:202:face:b00c:0:8c (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
ad.atdmt.com
16    69.172.216.111 (New York, United States)

ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US)
dt.adsafeprotected.com
1    216.58.209.70 (Mountain View, United States)

ASN15169 (GOOGLE - Google Inc., US)
PTR: waw02s06-in-f6.1e100.net
ad.doubleclick.net
7    95.100.189.14 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-189-14.deploy.akamaitechnologies.com
c.betrad.com
1    37.187.148.39 (France)

ASN16276 (OVH, FR)
PTR: ns344960.ip-37-187-148.eu
j.adlooxtracking.com
1    62.67.193.85 (United Kingdom)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
pixel.rubiconproject.com
1    54.235.172.139 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-235-172-139.compute-1.amazonaws.com
stats.aws.rubiconproject.com
1    62.67.193.23 (United Kingdom)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
beacon-eu2.rubiconproject.com
1    2a00:1450:401b:801::2004 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.google.com
1    2a00:1450:4001:81d::2006 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
s0.2mdn.net
2    151.101.12.175 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
cdn.krxd.net
1    172.217.22.66 (Mountain View, United States)

ASN15169 (GOOGLE - Google Inc., US)
PTR: fra15s17-in-f2.1e100.net
googleads4.g.doubleclick.net
4    107.178.255.114 (Mountain View, United States)

ASN15169 (GOOGLE - Google Inc., US)
PTR: 114.255.178.107.bc.googleusercontent.com
pix.impdesk.com
1    184.73.198.237 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-184-73-198-237.compute-1.amazonaws.com
rtd-tm.everesttech.net
2    149.202.93.239 (France)

ASN16276 (OVH, FR)
PTR: ndata04.adlooxtracking.com
data04.adlooxtracking.com
2    46.137.181.13 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-46-137-181-13.eu-west-1.compute.amazonaws.com
beacon.krxd.net
1    54.88.53.255 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-88-53-255.compute-1.amazonaws.com
l.betrad.com
Domain Requested by
19 www.wired.co.uk www.google.ca
www.wired.co.uk
16 dt.adsafeprotected.com www.google.ca
12 wi-images.condecdn.net www.google.ca
www.wired.co.uk
11 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.google.ca
tpc.googlesyndication.com
10 pixel.adsafeprotected.com www.wired.co.uk
www.google.ca
9 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.google.ca
8 px.moatads.com www.google.ca
7 c.betrad.com www.google.ca
c.betrad.com
7 z.moatads.com securepubads.g.doubleclick.net
www.wired.co.uk
4 pix.impdesk.com www.google.ca
4 pagead2.googlesyndication.com securepubads.g.doubleclick.net
www.google.ca
s0.2mdn.net
3 cdn.adsafeprotected.com pixel.adsafeprotected.com
3 fastlane.rubiconproject.com ads.rubiconproject.com
3 www.google-analytics.com www.wired.co.uk
2 beacon.krxd.net www.google.ca
cdn.krxd.net
2 data04.adlooxtracking.com j.adlooxtracking.com
data04.adlooxtracking.com
2 cdn.krxd.net s0.2mdn.net
cdn.krxd.net
2 ad.atdmt.com www.google.ca
2 b.scorecardresearch.com www.wired.co.uk
2 covers.condenast.co.uk www.wired.co.uk
2 www.google.ca
1 l.betrad.com www.google.ca
1 rtd-tm.everesttech.net www.wired.co.uk
1 googleads4.g.doubleclick.net www.google.ca
1 s0.2mdn.net www.google.ca
s0.2mdn.net
1 www.google.com www.google.ca
1 beacon-eu2.rubiconproject.com www.google.ca
1 stats.aws.rubiconproject.com www.google.ca
1 pixel.rubiconproject.com www.wired.co.uk
1 j.adlooxtracking.com www.google.ca
1 ad.doubleclick.net www.google.ca
1 www.googletagservices.com www.wired.co.uk
1 ads.rubiconproject.com www.wired.co.uk
1 secure-uk.imrworldwide.com www.wired.co.uk
1 www.googletagmanager.com www.wired.co.uk
0 tap2-cdn.rubiconproject.com Failed www.wired.co.uk
148 36
Subject Issuer Validity Valid
*.google.com
Google Internet Authority G2		 2017-05-31 -
2017-08-23		 3 months crt.sh
*.condenast.co.uk
RapidSSL SHA256 CA		 2016-09-25 -
2017-09-25		 a year crt.sh
*.google-analytics.com
Google Internet Authority G2		 2017-05-31 -
2017-08-23		 3 months crt.sh
*.condecdn.net
RapidSSL SHA256 CA		 2016-11-18 -
2017-11-18		 a year crt.sh
*.g.doubleclick.net
Google Internet Authority G2		 2017-05-31 -
2017-08-23		 3 months crt.sh
tpc.googlesyndication.com
Google Internet Authority G2		 2017-05-31 -
2017-08-23		 3 months crt.sh
*.moatads.com
RapidSSL SHA256 CA		 2016-04-13 -
2017-07-13		 a year crt.sh
*.atlassolutions.com
DigiCert SHA2 High Assurance Server CA		 2017-04-27 -
2018-05-31		 a year crt.sh
*.doubleclick.net
Google Internet Authority G2		 2017-05-31 -
2017-08-23		 3 months crt.sh
*.betrad.com
Symantec Class 3 Secure Server CA - G4		 2017-02-23 -
2018-02-23		 a year crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA		 2016-01-12 -
2019-03-01		 3 years crt.sh
*.c.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2017-04-13 -
2017-10-12		 6 months crt.sh
*.impdesk.com
Starfield Secure Certificate Authority - G2		 2017-05-04 -
2018-04-03		 a year crt.sh
*.tubemogul.com
DigiCert SHA2 Secure Server CA		 2016-08-15 -
2017-09-13		 a year crt.sh
*.adlooxtracking.com
RapidSSL SHA256 CA - G4		 2015-09-06 -
2017-12-07		 2 years crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2		 2017-04-25 -
2019-06-24		 2 years crt.sh

This page contains 14 frames:

Frame: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Frame ID: 7760.1
Requests: 3 HTTP requests in this frame

Frame: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Frame ID: 7775.1
Requests: 82 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 7775.3
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 7775.2
Requests: 6 HTTP requests in this frame

Frame: http://cdn.adsafeprotected.com/sca.17.2.10.js
Frame ID: 7775.7
Requests: 1 HTTP requests in this frame

Frame: https://ad.doubleclick.net/ddm/adj/N6090.2180301INFECTIOUSMEDIA-IMP/B10946462.146520476;u=idb,50510,66924,WTlKjuFddgo2GR7k;sz=728x90;kw=IDB50510,IDB66924;ord=1496926862955620364;click=http://pix.impdesk.com/click?a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms&redirect=;?
Frame ID: 7775.10
Requests: 27 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Frame ID: 7775.4
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/client/ext/m_window_focus_non_hydra.js
Frame ID: 7775.5
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/client/ext/m_window_focus_non_hydra.js
Frame ID: 7775.6
Requests: 7 HTTP requests in this frame

Frame: http://cdn.adsafeprotected.com/sca.17.2.10.js
Frame ID: 7775.11
Requests: 1 HTTP requests in this frame

Frame: http://cdn.adsafeprotected.com/sca.17.2.10.js
Frame ID: 7775.14
Requests: 1 HTTP requests in this frame

Frame: http://tpc.googlesyndication.com/sodar/9im3l02I.html
Frame ID: 7775.16
Requests: 1 HTTP requests in this frame

Frame: http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?pc=11644/36210&geo=eu&co=de
Frame ID: 7775.17
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/3948241/1481725599247/728x90-flexibility/index.html
Frame ID: 7775.18
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

148
Requests

49 %
HTTPS

38 %
IPv6

22
Domains

36
Subdomains

38
IPs

5
Countries

1523 kB
Transfer

4465 kB
Size

24
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request 5
  • https://covers.condenast.co.uk/api/v1/wi/current/image/print/300/
  • https://covers.condenast.co.uk/api/v1/wi/2017/4/image/print/300/
Request 6
  • https://covers.condenast.co.uk/api/v1/wi/current/image/tablet/300/
  • https://covers.condenast.co.uk/api/v1/wi/2017/4/image/tablet/300/
Request 11
  • http://secure-uk.imrworldwide.com/cgi-bin/m?ci=uk-405185h&cg=0&cc=1&si=http%3A//www.wired.co.uk/article/wanna-decryptor-ransomware&rp=https%3A//www.google.ca/&ts=compact&rnd=1496926862348
  • http://secure-uk.imrworldwide.com/cgi-bin/m?ci=uk-405185h&cg=0&cc=1&si=http%3A//www.wired.co.uk/article/wanna-decryptor-ransomware&rp=https%3A//www.google.ca/&ts=compact&rnd=1496926862348&ja=1
Request 13
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
Request 21
  • http://b.scorecardresearch.com/b?c1=2&c2=15335235&ns__t=1496926862400&ns_c=UTF-8&cv=3.1&c8=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&c7=http%3A%2F%2Fwww.wired...
  • http://b.scorecardresearch.com/b2?c1=2&c2=15335235&ns__t=1496926862400&ns_c=UTF-8&cv=3.1&c8=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&c7=http%3A%2F%2Fwww.wire...
Request 22
  • http://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&d...
  • https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&...
Request 23
  • http://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&d...
  • https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&...
Request 33
  • https://wi-images.condecdn.net/image/wRb3NpDrMql/crop/200/square
  • https://wi-images.condecdn.net/image/wRb3NpDrMql/crop/200
Request 70
  • https://pix.impdesk.com/csync/fire/provider?inc=rubicon
  • https://pixel.rubiconproject.com/tap.php?v=17913&nid=2931&put=59394a8fc1ed0a0a765029de&expires=30
Request 118
  • https://rtd.tubemogul.com/upi/?sid=wErJuM46D7a1ctlH6iei
  • https://rtd-tm.everesttech.net/upi/?sid=wErJuM46D7a1ctlH6iei

148 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request url
www.google.ca/
Redirect Chain
  • http://autonomicit.us14.list-manage.com/track/click?u=b3d10b8b1bb82214ea13e07c8&id=c8616e825f&e=23307ecf7c
  • https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&us...
 		492 B
304 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:401b:801::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
gws /
Resource Hash
bb854b0a9cccbc78e34e4450f357de5e5764c9ddae6c1cecd285fb4bc9560c85
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
cache-control
no-cache
:authority
www.google.ca
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 08 Jun 2017 13:01:00 GMT
content-encoding
gzip
server
gws
p3p
CP="This is not a P3P policy! See https://www.google.com/support/accounts/answer/151657?hl=en for more info."
status
200
cache-control
no-cache, must-revalidate
set-cookie
NID=105=QNrkbIwwijZcGp3TsgKceH-gAoY-T9OCT9Ts94mIofZpRDQuecA2Glw09mq0B0LCrCHsXLo_E35Uj2QKEHlrDxZFHa1wFjtFlYE2AzPd5KX2CgLnRRKjTiXB_c_1YrsM; expires=Fri, 08-Dec-2017 13:01:00 GMT; path=/; domain=.google.ca; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
295
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Thu, 08 Jun 2017 13:01:00 GMT
Content-Encoding
gzip
Server
openresty
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Location
https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Connection
keep-alive
Set-Cookie
_AVESTA_ENVIRONMENT=prod; path=/
Content-Length
20
X-UA-Compatible
IE=edge,chrome=1
wanna-decryptor-ransomware
www.wired.co.uk/article/ 		0
0
favicon.ico
www.google.ca/ 		5 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.ca/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:401b:801::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/favicon.ico
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.google.ca
cookie
NID=105=QNrkbIwwijZcGp3TsgKceH-gAoY-T9OCT9Ts94mIofZpRDQuecA2Glw09mq0B0LCrCHsXLo_E35Uj2QKEHlrDxZFHa1wFjtFlYE2AzPd5KX2CgLnRRKjTiXB_c_1YrsM
:scheme
https
referer
https://www.google.ca/
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
https://www.google.ca/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Fri, 02 Jun 2017 17:29:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 08 Dec 2016 01:00:57 GMT
server
sffe
age
502274
vary
Accept-Encoding
content-type
image/x-icon
status
200
cache-control
public, max-age=691200
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
1494
x-xss-protection
1; mode=block
expires
Sat, 10 Jun 2017 17:29:46 GMT
wanna-decryptor-ransomware
www.wired.co.uk/article/ Frame 7775 		152 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:4a00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
db5c07a4d05acff4c2e67f7ac28a370de49f5998bbd758841cd2ec60f7c84066

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer
https://www.google.ca/
Connection
keep-alive
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Referer
https://www.google.ca/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:01 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 13:01:01 GMT
Server
nginx
Vary
Accept-Encoding
X-Cache
Miss from cloudfront
Content-Type
text/html; charset=utf-8
Via
1.1 0cbd8799a17a2d96a24ab9504cb8ff1f.cloudfront.net (CloudFront)
Cache-Control
max-age=600
Transfer-Encoding
chunked
X-Arnie
Get to the chopper
Connection
keep-alive
X-Amz-Cf-Id
IASGp_w9dNLBBM7mYUV5HjHnZyyvQuADEijCvtXk5a9_BWoTu0CkfA==
Expires
Thu, 08 Jun 2017 13:11:00 GMT
page.min.css
www.wired.co.uk/static/css/ Frame 7775 		190 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/css/page.min.css
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:4a00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
d610d2df82f2c9ab6c1eb029aa98df866e30ee534bd8a908b811e8ad25ab7ede

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Mon, 05 Jun 2017 10:03:22 GMT
Content-Encoding
gzip
Age
522
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Wed, 31 May 2017 09:15:53 GMT
Server
nginx
ETag
W/"592e89c9-2f622"
Vary
Accept-Encoding
Content-Type
text/css
Via
1.1 0cbd8799a17a2d96a24ab9504cb8ff1f.cloudfront.net (CloudFront)
Cache-Control
max-age=900 public
X-Amz-Cf-Id
s8fWd4gNO6IyoW7AMUCTlXrGwMDREbGfRfo7Trg0y9zx1zkQDm5ubw==
Expires
Mon, 05 Jun 2017 10:18:22 GMT
tiny.gif
www.wired.co.uk/static/img/ Frame 7775 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.wired.co.uk/static/img/tiny.gif
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:8200:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
8c2789be580b7cd332e266ef9ea3fd3b0e3e51dc1cfd0f3474e8a54b6eb08b8e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
public
Date
Tue, 04 Apr 2017 00:48:45 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Tue, 22 Nov 2016 15:49:05 GMT
Server
nginx
Age
163
ETag
"583468f1-449"
X-Cache
Hit from cloudfront
Content-Type
image/gif
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1097
X-Amz-Cf-Id
rqJ26VVBTWjP6vssCJiC4b7oLYAZCrUUkR3JOT62iS9ykQLnyqfy7A==
Expires
Tue, 04 Apr 2017 01:03:45 GMT
/
covers.condenast.co.uk/api/v1/wi/2017/4/image/print/300/ Frame 7775
Redirect Chain
  • https://covers.condenast.co.uk/api/v1/wi/current/image/print/300/
  • https://covers.condenast.co.uk/api/v1/wi/2017/4/image/print/300/
 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://covers.condenast.co.uk/api/v1/wi/2017/4/image/print/300/
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2041:a400:2:75ac:ea80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.13.0 /
Resource Hash
d5fcce798c65ea9bf707effef1a45ad9b11649b6b29314fd0e4d2cc32041c8ae

Request headers

:path
/api/v1/wi/2017/4/image/print/300/
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
covers.condenast.co.uk
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 09:06:35 GMT
via
1.1 54d141057f6041e733ddef62e757e239.cloudfront.net (CloudFront)
last-modified
Thu, 08 Jun 2017 09:06:35 GMT
server
nginx/1.13.0
age
14067
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=21600
x-amz-cf-id
DiLz0berr2o2y-rSri-UJgPfSNV8NvMJ-2GgaK5z8ASk9jcFcO6WJw==
expires
Thu, 08 Jun 2017 15:06:35 GMT

Redirect headers

date
Thu, 08 Jun 2017 12:52:50 GMT
via
1.1 54d141057f6041e733ddef62e757e239.cloudfront.net (CloudFront)
last-modified
Thu, 08 Jun 2017 12:52:50 GMT
server
nginx/1.13.0
age
492
status
302
x-cache
Hit from cloudfront
content-type
text/html; charset=utf-8
location
https://covers.condenast.co.uk/api/v1/wi/2017/4/image/print/300/
cache-control
max-age=600
content-length
275
x-amz-cf-id
Ccz4Cw4858Po9pcfE6AzJf532GQ59HMXKq9_B5jTgFkJASLu36CGfw==
expires
Thu, 08 Jun 2017 13:02:50 GMT
/
covers.condenast.co.uk/api/v1/wi/2017/4/image/tablet/300/ Frame 7775
Redirect Chain
  • https://covers.condenast.co.uk/api/v1/wi/current/image/tablet/300/
  • https://covers.condenast.co.uk/api/v1/wi/2017/4/image/tablet/300/
 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://covers.condenast.co.uk/api/v1/wi/2017/4/image/tablet/300/
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2041:a400:2:75ac:ea80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.13.0 /
Resource Hash
d5fcce798c65ea9bf707effef1a45ad9b11649b6b29314fd0e4d2cc32041c8ae

Request headers

:path
/api/v1/wi/2017/4/image/tablet/300/
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
covers.condenast.co.uk
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 10:34:59 GMT
via
1.1 54d141057f6041e733ddef62e757e239.cloudfront.net (CloudFront)
last-modified
Thu, 08 Jun 2017 10:34:58 GMT
server
nginx/1.13.0
age
8763
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=21600
x-amz-cf-id
xRrMMWoDCZQYz8yySXZ4mum1kDC_MF6li7W_TqRjWOlp4bDW4TcKkw==
expires
Thu, 08 Jun 2017 16:34:58 GMT

Redirect headers

date
Thu, 08 Jun 2017 12:53:28 GMT
via
1.1 54d141057f6041e733ddef62e757e239.cloudfront.net (CloudFront)
last-modified
Thu, 08 Jun 2017 12:53:28 GMT
server
nginx/1.13.0
age
454
status
302
x-cache
Hit from cloudfront
content-type
text/html; charset=utf-8
location
https://covers.condenast.co.uk/api/v1/wi/2017/4/image/tablet/300/
cache-control
max-age=600
content-length
277
x-amz-cf-id
wAWOdwh1JlynUoCRWDkYmkIgz3m_YgbNcqddAfKceDXxszOx-eUHpQ==
expires
Thu, 08 Jun 2017 13:03:28 GMT
core.min.js
www.wired.co.uk/static/js/ Frame 7775 		137 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/js/core.min.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:8200:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
308f8bdcf38cb0444e21460cbeab65cb8870a50da2115f7813943ccbe203b3a3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 01 Jun 2017 03:22:45 GMT
Content-Encoding
gzip
Age
339
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Wed, 31 May 2017 09:15:58 GMT
Server
nginx
ETag
W/"592e89ce-2241c"
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Cache-Control
max-age=900 public
X-Amz-Cf-Id
slP71QhG2G-JNsoTmrybaWRq9z7UjJ4xf4RURuEdLMlnZ5d4Uj8nlQ==
Expires
Thu, 01 Jun 2017 03:37:45 GMT
ads.js
www.wired.co.uk/static/js/ Frame 7775 		27 B
27 B 		Script
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/js/ads.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:4a00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
1228207bc671da7b6cce0ca73c10ee4e059055f521c0dcc9bffe6fbca1c16306

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
public
Date
Thu, 01 Jun 2017 14:57:12 GMT
Via
1.1 0cbd8799a17a2d96a24ab9504cb8ff1f.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
40
ETag
"592e894e-1b"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27
X-Amz-Cf-Id
HKxeCzpI1HlkHXn2n2brlvvB1WZ0ukO5QVpuHQYCcVp44W6XHj2GFg==
Expires
Thu, 01 Jun 2017 15:12:12 GMT
article.min.js
www.wired.co.uk/static/js/ Frame 7775 		66 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/js/article.min.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:8200:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
270ac0c10812122c6dc17a0c4a8d6e0665a4d87e47e382f02219707125263aff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 20:19:58 GMT
Content-Encoding
gzip
Age
33
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Wed, 31 May 2017 09:15:58 GMT
Server
nginx
ETag
W/"592e89ce-10796"
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 0b1b12cfcb11f71988a190f16ef65179.cloudfront.net (CloudFront)
Cache-Control
max-age=900 public
X-Amz-Cf-Id
6-BH1G3hG9MKkF0SNJVQ0IYVLaZ62kll5lKDF94GynwUjTtSamsdGw==
Expires
Wed, 07 Jun 2017 20:34:58 GMT
gtm.js
www.googletagmanager.com/ Frame 7775 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googletagmanager.com/gtm.js?id=GTM-NDZ7G6
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2a00:1450:401b:800::2008 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
72439b41fcc41f01b52310c6bb38eb1a4ae190cbb079661f453a8661f6af174c
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.googletagmanager.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:02 GMT
Content-Encoding
gzip
Server
Google Tag Manager (scaffolding)
Vary
Accept-Encoding
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
http://www.googletagmanager.com
Cache-Control
private, max-age=900
Access-Control-Allow-Headers
Cache-Control
Content-Length
17185
X-XSS-Protection
1; mode=block
Expires
Thu, 08 Jun 2017 13:01:02 GMT
m
secure-uk.imrworldwide.com/cgi-bin/ Frame 7775
Redirect Chain
  • http://secure-uk.imrworldwide.com/cgi-bin/m?ci=uk-405185h&cg=0&cc=1&si=http%3A//www.wired.co.uk/article/wanna-decryptor-ransomware&rp=https%3A//www.google.ca/&ts=compact&rnd=1496926862348
  • http://secure-uk.imrworldwide.com/cgi-bin/m?ci=uk-405185h&cg=0&cc=1&si=http%3A//www.wired.co.uk/article/wanna-decryptor-ransomware&rp=https%3A//www.google.ca/&ts=compact&rnd=1496926862348&ja=1
 		44 B
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://secure-uk.imrworldwide.com/cgi-bin/m?ci=uk-405185h&cg=0&cc=1&si=http%3A//www.wired.co.uk/article/wanna-decryptor-ransomware&rp=https%3A//www.google.ca/&ts=compact&rnd=1496926862348&ja=1
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
138.108.96.100 Schaumburg, United States, ASN16477 (ACNIELSEN-AS - ACNIELSEN, US),
Reverse DNS
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
secure-uk.imrworldwide.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
IMRID=644e6c84-85f6-4c11-b056-e21ac18d883c
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
44
Expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Location
http://secure-uk.imrworldwide.com/cgi-bin/m?ci=uk-405185h&cg=0&cc=1&si=http%3A//www.wired.co.uk/article/wanna-decryptor-ransomware&rp=https%3A//www.google.ca/&ts=compact&rnd=1496926862348&ja=1
Set-Cookie
IMRID=644e6c84-85f6-4c11-b056-e21ac18d883c;Path=/;Domain=imrworldwide.com;Expires=Sat, 08-Jun-2019 13:01:02 GMT;Max-Age=63072000
Cache-Control
no-cache
Connection
close
Content-Length
0
Expires
Thu, 01 Dec 1994 16:00:00 GMT
beacon.js
b.scorecardresearch.com/ Frame 7775 		1 KB
901 B 		Script
General
Check archive.org
Download Go to
Full URL
http://b.scorecardresearch.com/beacon.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
95.100.248.115 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-115.deploy.akamaitechnologies.com
Software
/
Resource Hash
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:02 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=1209600
Connection
keep-alive
Content-Length
901
Expires
Thu, 22 Jun 2017 13:01:02 GMT
analytics.js
www.google-analytics.com/ Frame 7775
Redirect Chain
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
 		29 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
21a8144e29cf2f60d7361fa7bd962e302b324573faecadeb4992e450954b532d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

:path
/analytics.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.google-analytics.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 31 May 2017 23:40:38 GMT
server
Golfe2
age
6307
date
Thu, 08 Jun 2017 11:15:55 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
12349
expires
Thu, 08 Jun 2017 13:15:55 GMT

Redirect headers

Location
https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason
HSTS
Exchange-Web-Roman.woff2
www.wired.co.uk/static/fonts/exchange-web/ Frame 7775 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/exchange-web/Exchange-Web-Roman.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:4a00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
f061903e91136a670ee391e65b5b85f0dfa50939e3c7febb662e30502a5540a2

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Sun, 04 Jun 2017 21:18:12 GMT
Via
1.1 0cbd8799a17a2d96a24ab9504cb8ff1f.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
339
ETag
"592e894e-69ac"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27052
X-Amz-Cf-Id
XnalDWWDxaxWZ3zs0aL7sc8yTPDkuSf1DzsgRRUKJWLs1-c0lbTIYg==
Expires
Sun, 04 Jun 2017 21:33:12 GMT
BrutalType-Bold.woff2
www.wired.co.uk/static/fonts/brutal-type/ Frame 7775 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/brutal-type/BrutalType-Bold.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:d000:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
285c72953eb85aeef5a80f8f900d0066e0a714565dd63c1adee46c67e1138159

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Sat, 03 Jun 2017 03:31:31 GMT
Via
1.1 a9663235241a881e6187d8d87d15b277.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
339
ETag
"592e894e-4c90"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19600
X-Amz-Cf-Id
vx27qou8Y5geYE5v_Nuty7yXm9TtsTUNJM97ruwLf-IqfMVUwMgA8g==
Expires
Sat, 03 Jun 2017 03:46:31 GMT
BrutalType-Light.woff2
www.wired.co.uk/static/fonts/brutal-type/ Frame 7775 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/brutal-type/BrutalType-Light.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
1aac7ab7b21ee9a7169669311e9858868ad5c0e98214bfb1b21f5e45ddb1f322

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Thu, 01 Jun 2017 15:33:26 GMT
Via
1.1 0b1b12cfcb11f71988a190f16ef65179.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
315
ETag
"592e894e-4f18"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
20248
X-Amz-Cf-Id
Y2KqL4zDXnuyHu4gV3oa6a36xJrjCUy1jN2Cxk6kjrPM6TCDoMzGmQ==
Expires
Thu, 01 Jun 2017 15:48:26 GMT
BrutalType-Medium.woff2
www.wired.co.uk/static/fonts/brutal-type/ Frame 7775 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/brutal-type/BrutalType-Medium.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
70ccb2c9bbcaff90719cf917e90b949cf9b2cb71fb6d27e3cc0f6f69ac813725

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Thu, 01 Jun 2017 21:39:15 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
339
ETag
"592e894e-4b10"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19216
X-Amz-Cf-Id
3GqNlZ6FaGkcX8MJuLDksNo4leELnuYGbsVZ6rVyQ7Z5DIgZyP9KqA==
Expires
Thu, 01 Jun 2017 21:54:15 GMT
New-Grotesk-Square-Light.woff2
www.wired.co.uk/static/fonts/new-grotesk-square/ Frame 7775 		46 KB
46 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/new-grotesk-square/New-Grotesk-Square-Light.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:8200:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
913529a1ab355be3064eee81a60e3d79fbbd2702df8a1da88437ee7fb80115e3

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Sat, 03 Jun 2017 03:31:32 GMT
Via
1.1 0b1b12cfcb11f71988a190f16ef65179.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
474
ETag
"592e894e-b670"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
46704
X-Amz-Cf-Id
zNHZhpJndL71MPdm6FW45t83KUyACMwsxng31ldhWyjs-xSQCDKQGA==
Expires
Sat, 03 Jun 2017 03:46:32 GMT
Exchange-Web-Italic.woff2
www.wired.co.uk/static/fonts/exchange-web/ Frame 7775 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/exchange-web/Exchange-Web-Italic.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:8200:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
c5b6a6c4915c90208d9b974b47815e9ec73ded1494a1793ed28eae2ff0e23b9a

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Sat, 03 Jun 2017 03:31:31 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
339
ETag
"592e894e-5928"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22824
X-Amz-Cf-Id
uncXpH0TA1AG4Hk6ijJnzj2aa8kUu5O5pIbmJW5IBSbJJ4Hc9pQaVw==
Expires
Sat, 03 Jun 2017 03:46:31 GMT
Exchange-Web-Semibold.woff2
www.wired.co.uk/static/fonts/exchange-web/ Frame 7775 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/fonts/exchange-web/Exchange-Web-Semibold.woff2
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
c937f9cdc6de247e1b571b2210a1c0a853cc324aff18b8598649daaa4bdec25a

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/static/css/page.min.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/static/css/page.min.css
Origin
http://www.wired.co.uk

Response headers

Pragma
public
Date
Fri, 02 Jun 2017 13:32:14 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Wed, 31 May 2017 09:13:50 GMT
Server
nginx
Age
339
ETag
"592e894e-6c08"
X-Cache
Hit from cloudfront
Content-Type
application/octet-stream
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27656
X-Amz-Cf-Id
98DR2DssyBfc07V3K0tKaQWJncxo5EqPqZJD1rB-V-M5rWfOmAoPaA==
Expires
Fri, 02 Jun 2017 13:47:14 GMT
b2
b.scorecardresearch.com/ Frame 7775
Redirect Chain
  • http://b.scorecardresearch.com/b?c1=2&c2=15335235&ns__t=1496926862400&ns_c=UTF-8&cv=3.1&c8=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&c7=http%3A%2F%2Fwww.wired...
  • http://b.scorecardresearch.com/b2?c1=2&c2=15335235&ns__t=1496926862400&ns_c=UTF-8&cv=3.1&c8=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&c7=http%3A%2F%2Fwww.wire...
 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://b.scorecardresearch.com/b2?c1=2&c2=15335235&ns__t=1496926862400&ns_c=UTF-8&cv=3.1&c8=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&c7=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&c9=https%3A%2F%2Fwww.google.ca%2F
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
95.100.248.115 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a95-100-248-115.deploy.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
b.scorecardresearch.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
UID=10395a1002481111aee9e401496926862; UIDR=1496926862
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Location
http://b.scorecardresearch.com/b2?c1=2&c2=15335235&ns__t=1496926862400&ns_c=UTF-8&cv=3.1&c8=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&c7=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&c9=https%3A%2F%2Fwww.google.ca%2F
Set-Cookie
UID=10395a1002481111aee9e401496926862; expires=Wed, 29-May-2019 13:01:02 GMT; path=/; domain=.scorecardresearch.com UIDR=1496926862; expires=Wed, 29-May-2019 13:01:02 GMT; path=/; domain=.scorecardresearch.com
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/r/ Frame 7775
Redirect Chain
  • http://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&d...
  • https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&...
 		35 B
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&de=UTF-8&dt=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=aEDAAEABM~&jid=688506249&gjid=927366239&cid=661310791.1496926863&tid=UA-8086546-1&_gid=1375290225.1496926863&_r=1&cd1=Article&cd10=Fri%2C%2012%20May%202017%2015%3A59%3A52%20GMT&cd22=Tue%2C%2016%20May%202017%2009%3A52%3A11%20GMT&cd3=%2Farticle%2Fwanna-decryptor-ransomware&cd36=qDEPkpJvlK8&cd4=Ransomware&cd41=Friday&cd42=16&cd43=false&cd45=Tue%2C%2016%20May%202017%2009%3A52%3A00%20GMT&cd48=false&cd49=null&cd5=web&cd50=null&cd51=null&cd6=Ransomware%7CCyberattacks%7CSecurity%7CHacking&cd7=Victoria%20Woollaston&cd8=459&cd9=26&z=746156612
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&de=UTF-8&dt=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=aEDAAEABM~&jid=688506249&gjid=927366239&cid=661310791.1496926863&tid=UA-8086546-1&_gid=1375290225.1496926863&_r=1&cd1=Article&cd10=Fri%2C%2012%20May%202017%2015%3A59%3A52%20GMT&cd22=Tue%2C%2016%20May%202017%2009%3A52%3A11%20GMT&cd3=%2Farticle%2Fwanna-decryptor-ransomware&cd36=qDEPkpJvlK8&cd4=Ransomware&cd41=Friday&cd42=16&cd43=false&cd45=Tue%2C%2016%20May%202017%2009%3A52%3A00%20GMT&cd48=false&cd49=null&cd5=web&cd50=null&cd51=null&cd6=Ransomware%7CCyberattacks%7CSecurity%7CHacking&cd7=Victoria%20Woollaston&cd8=459&cd9=26&z=746156612
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.google-analytics.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 08 Jun 2017 13:01:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&de=UTF-8&dt=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=aEDAAEABM~&jid=688506249&gjid=927366239&cid=661310791.1496926863&tid=UA-8086546-1&_gid=1375290225.1496926863&_r=1&cd1=Article&cd10=Fri%2C%2012%20May%202017%2015%3A59%3A52%20GMT&cd22=Tue%2C%2016%20May%202017%2009%3A52%3A11%20GMT&cd3=%2Farticle%2Fwanna-decryptor-ransomware&cd36=qDEPkpJvlK8&cd4=Ransomware&cd41=Friday&cd42=16&cd43=false&cd45=Tue%2C%2016%20May%202017%2009%3A52%3A00%20GMT&cd48=false&cd49=null&cd5=web&cd50=null&cd51=null&cd6=Ransomware%7CCyberattacks%7CSecurity%7CHacking&cd7=Victoria%20Woollaston&cd8=459&cd9=26&z=746156612
Non-Authoritative-Reason
HSTS
collect
www.google-analytics.com/r/ Frame 7775
Redirect Chain
  • http://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&d...
  • https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&...
 		35 B
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&de=UTF-8&dt=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=aEDAAEABM~&jid=1100337591&gjid=828257712&cid=661310791.1496926863&tid=UA-15982414-1&_gid=1375290225.1496926863&_r=1&z=1125276913
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&de=UTF-8&dt=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=aEDAAEABM~&jid=1100337591&gjid=828257712&cid=661310791.1496926863&tid=UA-15982414-1&_gid=1375290225.1496926863&_r=1&z=1125276913
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.google-analytics.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 08 Jun 2017 13:01:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://www.google-analytics.com/r/collect?v=1&_v=j55&a=1637262223&t=pageview&_s=1&dl=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&dr=https%3A%2F%2Fwww.google.ca%2F&ul=en-us&de=UTF-8&dt=Wanna%20Decryptor%20ransomware%20latest%3A%20hack%20explained%20%7C%20WIRED%20UK&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=aEDAAEABM~&jid=1100337591&gjid=828257712&cid=661310791.1496926863&tid=UA-15982414-1&_gid=1375290225.1496926863&_r=1&z=1125276913
Non-Authoritative-Reason
HSTS
11644.js
ads.rubiconproject.com/header/ Frame 7775 		77 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://ads.rubiconproject.com/header/11644.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/static/js/core.min.js
Protocol
HTTP/1.1
Server
95.101.248.119 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-248-119.deploy.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
1a4917e8c8bc591b68a7465ba8e89cc7235dccf0712adf1577fe6787257375e6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
ads.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:02 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 May 2017 00:33:10 GMT
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
application/javascript
Cneonction
close
Connection
keep-alive
Content-Length
24234
Expires
Thu, 08 Jun 2017 13:01:02 GMT
square
wi-images.condecdn.net/image/wK1dDO3g5yq/crop/200/ Frame 7775 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/wK1dDO3g5yq/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
4b1bd7c0e4d4f895792e782dc10e2bf8c7e54c39ad0e87d5b861f937c080b05c

Request headers

:path
/image/wK1dDO3g5yq/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 12:44:18 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Thu, 08 Jun 2017 12:44:18 GMT
server
nginx/1.11.9
age
1005
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
wK1dDO3g5yq_200_dc1c08d710bdb11ae0c6f2f3e858f08b97fa98e87b05e06b182e8ce2ad4e6ec5
cache-control
max-age=5184000
content-length
6294
x-amz-cf-id
5LpNYbFon7NR7UDYy29wpXv5y4E48BiCxg32bu366AvWShxlA6C4Kw==
expires
Mon, 07 Aug 2017 12:44:18 GMT
square
wi-images.condecdn.net/image/vyzMl01DO6a/crop/200/ Frame 7775 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/vyzMl01DO6a/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
334d4f3169c74d17560212a6272a7605e6ebe9a333bc828ff919b897f0e8bf6e

Request headers

:path
/image/vyzMl01DO6a/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 12:19:49 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Thu, 08 Jun 2017 12:19:49 GMT
server
nginx/1.11.9
age
2474
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
vyzMl01DO6a_200_8b7da277dae2ed039931b41f8c59f6319c62402c28845cb8d9b25711381ec48a
cache-control
max-age=5184000
content-length
9789
x-amz-cf-id
hUxD5RwNiVjQr0aT-st3lWR_P9abwYHIRrJUSyZCxo57qKUbQERv_Q==
expires
Mon, 07 Aug 2017 12:19:49 GMT
square
wi-images.condecdn.net/image/GVv7dbkz0O2/crop/200/ Frame 7775 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/GVv7dbkz0O2/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
ca3863872db00555edc5587294ecc9ba9ceea809c4d79a3546f8ee3f0476aa6d

Request headers

:path
/image/GVv7dbkz0O2/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 10:03:30 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Thu, 08 Jun 2017 10:03:30 GMT
server
nginx/1.11.9
age
10653
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
GVv7dbkz0O2_200_26e41790a3187eca3ad30b8389c9e9979c96f8f43c542db95a3c6f276f8e3380
cache-control
max-age=5184000
content-length
8645
x-amz-cf-id
4nCii-at-y8h0oYcx2LAHjUZaDnVMb0HFf1Q0Jv3jNdhPg2QBoSIXQ==
expires
Mon, 07 Aug 2017 10:03:30 GMT
square
wi-images.condecdn.net/image/ea5bxG1JQ3j/crop/200/ Frame 7775 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/ea5bxG1JQ3j/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
d1503adac4592afadb3512556a9493d6d3c6b4c81ac477e8dfa1addfd0e39dc8

Request headers

:path
/image/ea5bxG1JQ3j/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 08:37:55 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Thu, 08 Jun 2017 08:37:55 GMT
server
nginx/1.11.9
age
15788
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
ea5bxG1JQ3j_200_b343292ae12fa684e9a7aa111f579a1a818676e7e09a29e3778d9e7b00323021
cache-control
max-age=5184000
content-length
8804
x-amz-cf-id
3KiCtTGvMFfSMW6xR13ua18sazlFhhYzy2rtGKANufvgV6YmWYY2zw==
expires
Mon, 07 Aug 2017 08:37:55 GMT
square
wi-images.condecdn.net/image/lbWORl2D7Qg/crop/200/ Frame 7775 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/lbWORl2D7Qg/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
e5f458a4ef5e2c5a88aa6e95166cfb6c43018a7f7abd162e44962408f853e0ba

Request headers

:path
/image/lbWORl2D7Qg/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Wed, 07 Jun 2017 08:20:14 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Wed, 07 Jun 2017 08:20:14 GMT
server
nginx/1.11.9
age
103249
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
lbWORl2D7Qg_200_b3e3b561aec8bc3ceb9212a0a7c2df21c620a79cf50fe8a5d91ac0db60ff3849
cache-control
max-age=5184000
content-length
9556
x-amz-cf-id
Kxa3xtYsYdM1kR3pJn0vazZ4ySKKe9mDXAcUTQhDaGNBz7RhCCOzFw==
expires
Sun, 06 Aug 2017 08:20:14 GMT
square
wi-images.condecdn.net/image/PBr1MBPoykD/crop/200/ Frame 7775 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/PBr1MBPoykD/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
e5e5791b5b8e76885e9601f3ca4752d23db5d3559c8aa078d9d69dde6b4f7079

Request headers

:path
/image/PBr1MBPoykD/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Mon, 05 Jun 2017 21:57:27 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Mon, 05 Jun 2017 21:57:27 GMT
server
nginx/1.11.9
age
227016
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
PBr1MBPoykD_200_faba39f221c55212daabba39b98dd6fc8606a236a18acc4ad516c0c595dc46b7
cache-control
max-age=5184000
content-length
8519
x-amz-cf-id
U3mmTdrPyTqJxowmZOI4a6ceimJFkv6pKqbfHQORhjtpPlVPw5zLOg==
expires
Fri, 04 Aug 2017 21:57:27 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 7775 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/static/js/core.min.js
Protocol
HTTP/1.1
Server
2a00:1450:401b:803::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
e9821a47343199c5cbd2aa1bbcfb63156505218ecab46b32a19b7215b37a2df8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.googletagservices.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 12:47:59 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 07 Jun 2017 18:24:27 GMT
Server
sffe
Age
783
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1357
X-XSS-Protection
1; mode=block
Expires
Thu, 08 Jun 2017 12:47:59 GMT
pubads_impl_121.js
securepubads.g.doubleclick.net/gpt/ Frame 7775 		185 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
sffe /
Resource Hash
ac4f9618be0b43e3a85ccb1b5ae9b9c5efbe4d1ac30bcd5db7b624a767024481
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gpt/pubads_impl_121.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 15:30:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
163834
status
200
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
65897
x-xss-protection
1; mode=block
last-modified
Tue, 06 Jun 2017 14:12:08 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 06 Jun 2018 15:30:28 GMT
200
wi-images.condecdn.net/image/wRb3NpDrMql/crop/ Frame 7775
Redirect Chain
  • https://wi-images.condecdn.net/image/wRb3NpDrMql/crop/200/square
  • https://wi-images.condecdn.net/image/wRb3NpDrMql/crop/200
 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/wRb3NpDrMql/crop/200
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
4b77c85f0c01d60126d5151609df823cce47ef123f1dcbab664b7fd255dc1374

Request headers

:path
/image/wRb3NpDrMql/crop/200
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Wed, 10 May 2017 12:47:13 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Wed, 10 May 2017 12:47:13 GMT
server
nginx/1.11.9
age
2506430
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
wRb3NpDrMql_200_1e5d37568ca8c402e5016212b93b79c18e0f7f94e364621416f2844003d26b95
cache-control
max-age=5184000
content-length
5850
x-amz-cf-id
gpqpQKFlXrAdJxXtjFYiI1X_pNdYrUB8EcCdt45EHN13e8HkSEah8w==
expires
Sun, 09 Jul 2017 12:47:13 GMT

Redirect headers

date
Fri, 14 Apr 2017 14:05:04 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
last-modified
Fri, 14 Apr 2017 14:05:02 GMT
server
nginx/1.11.9
age
4748159
status
302
x-cache
Hit from cloudfront
content-type
text/html; charset=utf-8
location
https://wi-images.condecdn.net/image/wRb3NpDrMql/crop/200
cache-control
max-age=5184000
content-length
321
x-amz-cf-id
bobb0cfqLMu6AXCSjEKuyUTaeXQG1yS9zBgik5qoJ_bSpHW3_MwU3A==
expires
Tue, 13 Jun 2017 14:05:02 GMT
810
wi-images.condecdn.net/image/Z6ZAZNgjnV0/crop/ Frame 7775 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/Z6ZAZNgjnV0/crop/810
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
f3f439511ea7c3536083910d282e2d0903329127b493ea73cf42759280b30cf0

Request headers

:path
/image/Z6ZAZNgjnV0/crop/810
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 18 May 2017 12:41:21 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Thu, 18 May 2017 12:41:21 GMT
server
nginx/1.11.9
age
1815582
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
Z6ZAZNgjnV0_810_2ebf95b40f7e88cca5cfcf51467132d48ce92877f764313b58be2a9c338832b2
cache-control
max-age=5184000
content-length
67522
x-amz-cf-id
3O4jKEME4EdtpazAbttFxo-QYuLfm1lr9idcx5g_nNKEsLetFyqI3w==
expires
Mon, 17 Jul 2017 12:41:21 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-8/html/ Frame 7775 		3 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://tpc.googlesyndication.com/safeframe/1-0-8/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
96d3bf038966f99afc2c91b78a83c887caf0456db1e58ed2c7be2504dde9e810
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Purpose
prefetch
Accept-Encoding
gzip, deflate, sdch
Host
tpc.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Purpose
prefetch
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 20:15:48 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 18 Apr 2017 21:46:52 GMT
Server
sffe
Age
60314
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, immutable, max-age=31536000
Accept-Ranges
bytes
Content-Length
1747
X-XSS-Protection
1; mode=block
Expires
Thu, 07 Jun 2018 20:15:48 GMT
Cookie set fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 7775 		7 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
http://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11644&size_id=15&p_pos=btf&rp_floor=0.01&rf=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&p_screen_res=1600x1200&tg_fl.eid=ad_4954815c-c110-4f8f-bbe9-4f68bbf9532f&tg_fl.uname=%2F5574%2Fuk.n5574.wired%2Fbusiness-politics%2Farticles&tg_fl.pr_acctid=11644&alt_size_ids=2%2C57&kw=rp.fastlane&tk_flint=plain&rand=0.6288139293879202
Requested by
Host: ads.rubiconproject.com
URL: http://ads.rubiconproject.com/header/11644.js
Protocol
HTTP/1.1
Server
62.67.193.21 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
d01c52ca43aaa120298d41522f3682e796658f0efb01d92ff0bde67cee3171b0

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
fastlane.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Origin
http://www.wired.co.uk

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
http://www.wired.co.uk
Set-Cookie
ruid=566e986e59394a8e94fb2daa5f70fd^1^1496926862^3162227865; Domain=.rubiconproject.com; Path=/; Expires=Wed, 06-Sep-2017 13:01:02 GMT; Max-Age=7776000 rsid=DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24; Domain=.rubiconproject.com; Path=/ ses2=36210^1; Domain=.rubiconproject.com; Path=/; Expires=Fri, 09-Jun-2017 05:59:59 GMT; Max-Age=61137 vis2=36210^1; Domain=.rubiconproject.com; Path=/; Expires=Fri, 09-Jun-2017 05:59:59 GMT; Max-Age=61137 csi2=; Domain=.rubiconproject.com; Path=/; Expires=Thu, 15-Jun-2017 13:01:02 GMT; Max-Age=604800 csc2=; Domain=.rubiconproject.com; Path=/; Expires=Thu, 15-Jun-2017 13:01:02 GMT; Max-Age=604800
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=4
Content-Length
2902
Expires
Wed, 17 Sep 1975 21:32:10 GMT
Cookie set fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 7775 		255 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11644&size_id=15&p_pos=btf&rp_floor=0.01&rf=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&p_screen_res=1600x1200&tg_fl.eid=ad_c7462027-9453-4fcb-acbc-7471895bff5e&tg_fl.uname=%2F5574%2Fuk.n5574.wired%2Fbusiness-politics%2Farticles&tg_fl.pr_acctid=11644&alt_size_ids=10&kw=rp.fastlane&tk_flint=plain&rand=0.3077738096886622
Requested by
Host: ads.rubiconproject.com
URL: http://ads.rubiconproject.com/header/11644.js
Protocol
HTTP/1.1
Server
62.67.193.21 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
2048910d091b4038586f4c3ac4ae4f3d0a07c694ae2f250b0cef9d0f6d77b882

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
fastlane.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Origin
http://www.wired.co.uk

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
http://www.wired.co.uk
Set-Cookie
ruid=566e986e59394a8e94fb2daa025dcd^1^1496926862^3162227865; Domain=.rubiconproject.com; Path=/; Expires=Wed, 06-Sep-2017 13:01:02 GMT; Max-Age=7776000 rsid=DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24; Domain=.rubiconproject.com; Path=/ ses15=; Domain=.rubiconproject.com; Path=/; Expires=Fri, 09-Jun-2017 05:59:59 GMT; Max-Age=61137 vis15=36210^1; Domain=.rubiconproject.com; Path=/; Expires=Fri, 09-Jun-2017 05:59:59 GMT; Max-Age=61137 csi15=; Domain=.rubiconproject.com; Path=/; Expires=Thu, 15-Jun-2017 13:01:02 GMT; Max-Age=604800 csc15=; Domain=.rubiconproject.com; Path=/; Expires=Thu, 15-Jun-2017 13:01:02 GMT; Max-Age=604800
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=91
Content-Length
255
Expires
Wed, 17 Sep 1975 21:32:10 GMT
Cookie set fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 7775 		235 B
235 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11644&size_id=15&p_pos=btf&rp_floor=0.01&rf=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&p_screen_res=1600x1200&tg_fl.eid=ad_a3356501-e27a-4c13-ac01-45bbd0cacf75&tg_fl.uname=%2F5574%2Fuk.n5574.wired%2Fbusiness-politics%2Farticles&tg_fl.pr_acctid=11644&kw=rp.fastlane&tk_flint=plain&rand=0.4315997673855847
Requested by
Host: ads.rubiconproject.com
URL: http://ads.rubiconproject.com/header/11644.js
Protocol
HTTP/1.1
Server
62.67.193.61 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
51144c1675de608488b78ff0316e911d9f030842c323cdaaa4f12e0f4614ba48

Request headers

Pragma
no-cache
Origin
http://www.wired.co.uk
Accept-Encoding
gzip, deflate, sdch
Host
fastlane.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Origin
http://www.wired.co.uk

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:02 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
http://www.wired.co.uk
Set-Cookie
ruid=566e9c6759394a8e94fb2daa50353a^1^1496926862^3162227865; Domain=.rubiconproject.com; Path=/; Expires=Wed, 06-Sep-2017 13:01:02 GMT; Max-Age=7776000 rsid=DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24; Domain=.rubiconproject.com; Path=/ ses15=; Domain=.rubiconproject.com; Path=/; Expires=Fri, 09-Jun-2017 05:59:59 GMT; Max-Age=61137 vis15=36210^1; Domain=.rubiconproject.com; Path=/; Expires=Fri, 09-Jun-2017 05:59:59 GMT; Max-Age=61137 csi15=; Domain=.rubiconproject.com; Path=/; Expires=Thu, 15-Jun-2017 13:01:02 GMT; Max-Age=604800 csc15=; Domain=.rubiconproject.com; Path=/; Expires=Thu, 15-Jun-2017 13:01:02 GMT; Max-Age=604800
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=58
Content-Length
235
Expires
Wed, 17 Sep 1975 21:32:10 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 7775 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=762283146797029&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=108809080%2C108809107&sc=0&sfv=1-0-8&iu_parts=5574%2Cuk.n5574.wired%2Cbusiness-politics%2Carticles&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&prev_scp=position%3Dpromotion-small%26doctype%3Darticle%26pos%3Dpromotionbutton%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking&eri=1&cookie_enabled=1&abxe=1&lmt=1496926861&dt=1496926862925&frm=20&biw=1583&bih=1132&oid=3&adxs=0&adys=0&adks=1348455311&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ref=https%3A%2F%2Fwww.google.ca%2F&dssz=20&icsg=106559&mso=1&std=0&vrg=121&vrp=121&ga_vid=661310791.1496926863&ga_sid=1496926863&ga_hid=1637262223
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
03485a7aa4376e0d4c4247e53fbd781331c8620103358fc5f74b4b4b3a60fbb0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gampad/ads?gdfp_req=1&correlator=762283146797029&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=108809080%2C108809107&sc=0&sfv=1-0-8&iu_parts=5574%2Cuk.n5574.wired%2Cbusiness-politics%2Carticles&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&prev_scp=position%3Dpromotion-small%26doctype%3Darticle%26pos%3Dpromotionbutton%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking&eri=1&cookie_enabled=1&abxe=1&lmt=1496926861&dt=1496926862925&frm=20&biw=1583&bih=1132&oid=3&adxs=0&adys=0&adks=1348455311&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ref=https%3A%2F%2Fwww.google.ca%2F&dssz=20&icsg=106559&mso=1&std=0&vrg=121&vrp=121&ga_vid=661310791.1496926863&ga_sid=1496926863&ga_hid=1637262223
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:02 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
4314
x-xss-protection
1; mode=block
google-lineitem-id
857686997
pragma
no-cache
server
cafe
google-creative-id
113493514637
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
set-cookie
test_cookie=CheckForPermission; expires=Thu, 08-Jun-2017 13:16:02 GMT; path=/; domain=.doubleclick.net
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 7775 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=762283146797029&output=json_html&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&json_a=1&eid=108809080%2C108809107&sc=0&sfv=1-0-8&iu_parts=5574%2Cuk.n5574.wired%2Cbusiness-politics%2Carticles&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=5x5&prev_scp=doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking&eri=1&cookie_enabled=1&abxe=1&lmt=1496926861&dt=1496926862932&frm=20&biw=1583&bih=1132&oid=3&adxs=0&adys=0&adks=3520868240&gut=v2&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ref=https%3A%2F%2Fwww.google.ca%2F&dssz=21&icsg=630847&mso=1&std=0&vrg=121&vrp=121&ga_vid=661310791.1496926863&ga_sid=1496926863&ga_hid=1637262223
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
c2b9c24d3b675a69e331f4cc79f3fbb7a4c6181b3717276f3bf690c3ab36ad8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gampad/ads?gdfp_req=1&correlator=762283146797029&output=json_html&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&json_a=1&eid=108809080%2C108809107&sc=0&sfv=1-0-8&iu_parts=5574%2Cuk.n5574.wired%2Cbusiness-politics%2Carticles&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=5x5&prev_scp=doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking&eri=1&cookie_enabled=1&abxe=1&lmt=1496926861&dt=1496926862932&frm=20&biw=1583&bih=1132&oid=3&adxs=0&adys=0&adks=3520868240&gut=v2&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ref=https%3A%2F%2Fwww.google.ca%2F&dssz=21&icsg=630847&mso=1&std=0&vrg=121&vrp=121&ga_vid=661310791.1496926863&ga_sid=1496926863&ga_hid=1637262223
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:02 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
3695
x-xss-protection
1; mode=block
google-lineitem-id
776821277
pragma
no-cache
server
cafe
google-creative-id
98972786717
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
set-cookie
test_cookie=CheckForPermission; expires=Thu, 08-Jun-2017 13:16:02 GMT; path=/; domain=.doubleclick.net
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 7775 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
osd.js
pagead2.googlesyndication.com/pagead/ Frame 7775 		77 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Server
2a00:1450:401b:803::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
557007834448c888efaa01c2c1d25155130fea075308b3bdb1ea87662b82a2ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 12:39:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
Age
1315
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
ETag
5277057430624346146
Content-Type
text/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
29297
X-XSS-Protection
1; mode=block
Expires
Thu, 08 Jun 2017 13:39:08 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstg9V0R2VuwUdT83Nd8QwoI2yP3_ZejXfUjlhQJqDFtBSgWQtPGMvL2333HNXTlP5A7nTDWb8xupDB7ovT1TrR_g9S_NFUFbrlKMzD2jbf9bySRr4wbuzkhHZ039ZKtOXncCUDY-wxewHLsrOn245LDW6ua3j1pO9CzlhWCh3nvwV97ztEg7MsoUTQbTjPhBZSMl0vIWxlcBwzc9Cj_FSFF9-UswWZ1Kyc0w11E7CpuJlRPcXhRz2zfZfRCd7NedE-1vwPQj2p8sx-KVI5eQAdL4VE&sig=Cg0ArKJSzDHtb8qWhQP6EAE&urlfix=1&adurl=
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjstg9V0R2VuwUdT83Nd8QwoI2yP3_ZejXfUjlhQJqDFtBSgWQtPGMvL2333HNXTlP5A7nTDWb8xupDB7ovT1TrR_g9S_NFUFbrlKMzD2jbf9bySRr4wbuzkhHZ039ZKtOXncCUDY-wxewHLsrOn245LDW6ua3j1pO9CzlhWCh3nvwV97ztEg7MsoUTQbTjPhBZSMl0vIWxlcBwzc9Cj_FSFF9-UswWZ1Kyc0w11E7CpuJlRPcXhRz2zfZfRCd7NedE-1vwPQj2p8sx-KVI5eQAdL4VE&sig=Cg0ArKJSzDHtb8qWhQP6EAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 08 Jun 2017 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=22d911ecda1c000d||t=1496926863|et=730|cs=002213fd4830fc9410d1724345; expires=Sat, 08-Jun-2019 13:01:03 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUnA6dtY9DW4gStgO8komiVHDww0NBmJmKj6Y4jgBANFH75MA8MRTw; expires=Sat, 08-Jun-2019 13:01:03 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Thu, 08 Jun 2017 13:01:03 GMT
small
www.wired.co.uk/xhr/ads/native/ Frame 7775 		2 KB
611 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/xhr/ads/native/small?title=Inside%20Benfica%27s%20tech%20lab%20as%20it%20leads%20the%20team%20towards%20its%20fourth%20consecutive%20Primeira%20Liga%20title&brand=Microsoft%20Cloud&teaser_short=.&image_uid=kEBZpxjaEjl&style=0
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/static/js/core.min.js
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
259ab0d97c563730da806e47ade02b4503a17b39f8e572aa1afe5ed93ce44896

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
rollbar-referrer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_ga=GA1.3.661310791.1496926863; _gid=GA1.3.1375290225.1496926863; _gat_TRACKER0=1; _gat_TRACKER1=1; __gads=ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
rollbar-referrer
http://www.wired.co.uk/article/wanna-decryptor-ransomware

Response headers

Date
Thu, 08 Jun 2017 12:53:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 12:53:10 GMT
Server
nginx
Age
473
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/json
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Cache-Control
max-age=600
Transfer-Encoding
chunked
X-Arnie
Get to the chopper
Connection
keep-alive
X-Amz-Cf-Id
oAfBrYCVVbz8gEUqfM8MsCs-BXRVujld9ZOqaJ0DupPnVKZ7Djhrmg==
Expires
Thu, 08 Jun 2017 13:03:00 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 7775 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
view
securepubads.g.doubleclick.net/pcs/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqo5bzFut59-5AtXF4tvUdniGJ9OWqDEkRDInjrMvVKym8UniLbx7k6n3R_6nuA8vTZl6xDjq0-kvXQxH6NOicTOIu2RZ193kTeIdAEwM0Vtd-bcRZxbAv0TRVhUjPRUyCw6fFEIK9ZzDXJzWvZZlselUHbGey4lwWxk9_EroGTZ28qVZtGUeGEyQkPp7EPyXs1xaaxVNQIOD0HXVFm6bB8Fl49V0ZGCyHZr5xpxwsBBNG5FS3m2P4IqClYz4cJSdgCIYBnkeSYd7FSLKvcqIkYZk&sig=Cg0ArKJSzA93_7rkHMCaEAE&urlfix=1&adurl=
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsuqo5bzFut59-5AtXF4tvUdniGJ9OWqDEkRDInjrMvVKym8UniLbx7k6n3R_6nuA8vTZl6xDjq0-kvXQxH6NOicTOIu2RZ193kTeIdAEwM0Vtd-bcRZxbAv0TRVhUjPRUyCw6fFEIK9ZzDXJzWvZZlselUHbGey4lwWxk9_EroGTZ28qVZtGUeGEyQkPp7EPyXs1xaaxVNQIOD0HXVFm6bB8Fl49V0ZGCyHZr5xpxwsBBNG5FS3m2P4IqClYz4cJSdgCIYBnkeSYd7FSLKvcqIkYZk&sig=Cg0ArKJSzA93_7rkHMCaEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
test_cookie=CheckForPermission
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 08 Jun 2017 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
set-cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; expires=Sat, 08-Jun-2019 13:01:03 GMT; path=/; domain=.doubleclick.net test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A; expires=Sat, 08-Jun-2019 13:01:03 GMT; path=/; domain=.doubleclick.net; HttpOnly
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
expires
Thu, 08 Jun 2017 13:01:03 GMT
jload
pixel.adsafeprotected.com/ Frame 7775 		123 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pixel.adsafeprotected.com/jload?anId=9750&campId=5x5&pubId=12541037&chanId=118208237&placementId=776821277
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
c364eb4d3cac1555e3150ac08b756d9de5ac16182fa2dcff853baaabb9153d87

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
X-Server-Name
app28ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx/1.4.7
Expires
Wed, 31 Dec 1969 23:59:59 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
truncated
/ Frame 7775 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e5cfe524a65aa27412b013f6d7b84a766891b66f76f56ab3c67196ca58b565f7

Request headers

Response headers
jload
pixel.adsafeprotected.com/ Frame 7775 		123 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pixel.adsafeprotected.com/jload?anId=9750&campId=1x1&pubId=69849197&chanId=118208237&placementId=857686997
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
012372f12051016cb7845d7870a981995e93f5cc048adba0f445c4e01f2a6b23

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
X-Server-Name
app38ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx/1.11.6
Expires
Wed, 31 Dec 1969 23:59:59 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
truncated
/ Frame 7775 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1544b7868c135e61fb11eca856861fed7db03c229c374cca8ebf0682a97917e4

Request headers

Response headers
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=34&ud=0&ue=0&uu=0&qa=1600&qb=1200&qc=1&qd=1&qf=1598&qe=1132&qh=1598&qg=1198&qi=1600&qj=1200&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(u0.pVw!ry8k.%22%3A%3DMo%5Di*3oD%5BN%7BQO%3FSFm%5D)4m3%23(%3DNRpStZ.EfoG0Kc%5ENFnUz%22uCG&qo=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CONDEUK1&hp=1&zMoatPS=promotion-small&zMoatST=Site%20Not%20Defined&zMoatDT=article&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863102&de=695994888009&m=0&ar=7b317f9-clean&q=1&cb=0&cu=1496926863102&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=0&d=69849197%3A514398557%3A857686997%3A113493514637&qs=1&bo=8881277&bd=118208237&gw=condenastuk573198052690&fd=1&ac=1&it=500&fs=117120&na=279914688&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:03 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 7775 		39 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=762283146797029&output=json_html&callback=googletag.impl.pubads.callbackProxy3&impl=fifs&json_a=1&eid=108809080%2C108809107&sc=0&sfv=1-0-8&iu_parts=5574%2Cuk.n5574.wired%2Cbusiness-politics%2Carticles&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x90%7C970x250%7C1520x300%2C300x600%7C300x250%2C300x250%7C300x251&prev_scp=position%3Dbanner-top%26doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking%26rpfl_11644%3D2_tier100%26rpfl_elemid%3Dad_4954815c-c110-4f8f-bbe9-4f68bbf9532f%7Cposition%3Darticle-top%26doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking%26rpfl_elemid%3Dad_c7462027-9453-4fcb-acbc-7471895bff5e%7Cposition%3Darticle-bottom%26doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking%26rpfl_elemid%3Dad_a3356501-e27a-4c13-ac01-45bbd0cacf75&eri=1&cookie=ID%3D85b8b463cd338c14%3AT%3D1496926862%3AS%3DALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw&cookie_enabled=1&abxe=1&lmt=1496926861&dt=1496926863148&frm=20&biw=1583&bih=1132&oid=3&adxs=0%2C0%2C0&adys=0%2C0%2C0&adks=2311815512%2C3337969150%2C2619126570&gut=v2&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ref=https%3A%2F%2Fwww.google.ca%2F&dssz=23&icsg=11116607&mso=1&std=0&vrg=121&vrp=121&ga_vid=661310791.1496926863&ga_sid=1496926863&ga_hid=1637262223
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
32e156c1c8a7a9a992bcab36ad7e788f453948e89a51c1c373f7ac94d9894148
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/gampad/ads?gdfp_req=1&correlator=762283146797029&output=json_html&callback=googletag.impl.pubads.callbackProxy3&impl=fifs&json_a=1&eid=108809080%2C108809107&sc=0&sfv=1-0-8&iu_parts=5574%2Cuk.n5574.wired%2Cbusiness-politics%2Carticles&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x90%7C970x250%7C1520x300%2C300x600%7C300x250%2C300x250%7C300x251&prev_scp=position%3Dbanner-top%26doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking%26rpfl_11644%3D2_tier100%26rpfl_elemid%3Dad_4954815c-c110-4f8f-bbe9-4f68bbf9532f%7Cposition%3Darticle-top%26doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking%26rpfl_elemid%3Dad_c7462027-9453-4fcb-acbc-7471895bff5e%7Cposition%3Darticle-bottom%26doctype%3Darticle%26uk-wi-tags%3DRansomware%2CCyberattacks%2CSecurity%2CHacking%26rpfl_elemid%3Dad_a3356501-e27a-4c13-ac01-45bbd0cacf75&eri=1&cookie=ID%3D85b8b463cd338c14%3AT%3D1496926862%3AS%3DALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw&cookie_enabled=1&abxe=1&lmt=1496926861&dt=1496926863148&frm=20&biw=1583&bih=1132&oid=3&adxs=0%2C0%2C0&adys=0%2C0%2C0&adks=2311815512%2C3337969150%2C2619126570&gut=v2&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=5&u_nmime=7&u_sd=1&flash=25.0.0&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ref=https%3A%2F%2Fwww.google.ca%2F&dssz=23&icsg=11116607&mso=1&std=0&vrg=121&vrp=121&ga_vid=661310791.1496926863&ga_sid=1496926863&ga_hid=1637262223
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:03 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
7732
x-xss-protection
1; mode=block
google-lineitem-id
757020677,857690837,77042357
pragma
no-cache
server
cafe
google-creative-id
86016808517,113493498317,113497609037
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sca.17.2.10.js
cdn.adsafeprotected.com/ Frame 7775 		75 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn.adsafeprotected.com/sca.17.2.10.js
Requested by
Host: pixel.adsafeprotected.com
URL: http://pixel.adsafeprotected.com/jload?anId=9750&campId=5x5&pubId=12541037&chanId=118208237&placementId=776821277
Protocol
HTTP/1.1
Server
54.192.48.56 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-48-56.jfk5.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
03d319469fe8b4f4e92a763631f9fdad271cacc57d98484da54dcf233522a110

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 09 May 2017 10:30:36 GMT
Content-Encoding
gzip
Last-Modified
Fri, 24 Mar 2017 08:13:19 GMT
Server
AmazonS3
Age
75097
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 a81e162a9acc4a08f8778f221092bb6a.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
wQvfsC3hj82NECV6dSR2GRGtGI_axtIxDBwlwPPxyjz_gi-kP_WNWA==
mon
pixel.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pixel.adsafeprotected.com/mon?anId=9750&campId=5x5&pubId=12541037&chanId=118208237&placementId=776821277&adsafe_url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&adsafe_type=abedfq&adsafe_url=https%3A%2F%2Fwww.google.ca%2F&adsafe_type=c&adsafe_jsinfo=,id:a75d6586-70a2-1041-da18-0d077f794c9a,c:eX1FZb,sl:outOfView,em:true,fr:true,mn:app28ami,pt:1-5-15,wc:1.1.1598.1132,ac:1.1.0.0,am:i,cc:1.1.0.0,piv:NaN,obst:0,th:0,reas:l,cmps:1,br:c,fv:25.0.0,bv:na,dm:na,abv:na,an:n,fm:qlXGz5Y+11|12*.9750|13|14|15,idMap:12*,pl:VEBo.MZv9.jpov.0YtC.CV8L,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,uf:0,tt:jload,et:32,oid:86c9008b-4c4a-11e7-921a-382c4ac6312d,v:17.3.12,sp:0,ct:289,dtm:i,gtpl:0,wr:1598.1132,sr:1600.1200,ov:0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
app39ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.11.6
mon
pixel.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pixel.adsafeprotected.com/mon?anId=9750&campId=1x1&pubId=69849197&chanId=118208237&placementId=857686997&adsafe_url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&adsafe_type=abedfq&adsafe_url=https%3A%2F%2Fwww.google.ca%2F&adsafe_type=c&adsafe_jsinfo=,id:64ede64d-94b5-83fd-d5a5-c6c08c26dab6,c:eX1FZW,sl:inView,em:true,fr:true,mn:app38ami,pt:1-5-15,wc:1.1.1598.1132,ac:973.123.1.1,am:i,cc:1.1.1.0,piv:100,obst:0,th:0,reas:,cmps:1,br:c,fv:25.0.0,bv:na,dm:na,abv:na,an:n,fm:qlXGz6K+11*.9750|121|122|13|14|15,idMap:11*,pl:VEBo.MZv9.jpov.0YtC.CV8L,rt:1,cb:0,th:0,es:0,sa:1,sc:0,ha:1,gm:1,fif:0,uf:0,tt:jload,et:31,oid:86c975e7-4c4a-11e7-ab03-70106fb72758,v:17.3.12,sp:0,ct:336,dtm:i,gtpl:0,wr:1598.1132,sr:1600.1200,mf:-1593105340,ov:0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
app16ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
img;p=11087214228306;a=11087214228978;AAID=;IDFA=;CACHEBUSTER=429818888
ad.atdmt.com/i/ Frame 7775 		42 B
51 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.atdmt.com/i/img;p=11087214228306;a=11087214228978;AAID=;IDFA=;CACHEBUSTER=429818888
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a03:2880:f01c:202:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

:path
/i/img;p=11087214228306;a=11087214228978;AAID=;IDFA=;CACHEBUSTER=429818888
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
ad.atdmt.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 08 Jun 2017 13:01:03 GMT
x-atlas-debug
AYLMMdHKaJKVgXmc2G1BiEbH2jLqjAgQV3I56cT0UZqzkXoitg3C1Dl9jJLOGyo4nqM6gbUmnWEwf7F8zOcKIo8M
p3p
CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
status
200
cache-control
private, no-cache, no-store, must-revalidate
set-cookie
ATN=1.1496926863.6507117199618308840.AYJOe4Bvxk4_XcFHKbk; expires=Saturday, 08-Jun-2019 13:01:03 GMT; path=/; domain=.atdmt.com; HttpOnly
content-type
image/gif
content-length
42
expires
0
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CONDEUK1&hp=1&zMoatPS=promotion-small&zMoatST=Site%20Not%20Defined&zMoatDT=article&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863102&de=695994888009&m=0&ar=7b317f9-clean&q=2&cb=0&cu=1496926863102&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=0&d=69849197%3A514398557%3A857686997%3A113493514637&qs=1&bo=8881277&bd=118208237&gw=condenastuk573198052690&fd=1&ac=1&it=500&fs=117120&na=101494776&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:03 GMT
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=a75d6586-70a2-1041-da18-0d077f794c9a&tv={c:eX1G0B,pingTime:-2,time:119,type:a,sca:{avgrn1:0,dfp:{df:0}},env:{sf:0,pom:1},rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:0,o:119,n:0,pp:0,pm:0},slEvents:[{sl:o,t:30,wc:1.1.1598.1132,ac:1.1.0.0,am:i,cc:1.1.0.0,piv:NaN,obst:0,th:0,reas:l,cmps:1,bkn:{piv:[105~75],as:[105~0.0]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:0,fm:qlXGz5Y+11.9750|12*.9750|13|14|15,idMap:12*,pd:CV8L.internal-pdf-viewer,slid:[google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_7,google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_7__container__,ad_d03f7d65-f003-4097-8409-f25f8cfa5a61],avgrn:0,sinceFw:85,readyFired:true}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt63ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.11.6
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=34&ud=0&ue=0&uu=0&qa=1600&qb=1200&qc=1&qd=1&qf=1598&qe=1132&qh=1598&qg=1198&qi=1600&qj=1200&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(u0.pVw!ry8k.%22%3A%3DMo%5Di*3oD%5BN%7BQO%3FSFm%5D)4m3%23(%3DNRpStZ.EfoG0Kc%5ENFnUz%22uCG&qo=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CONDEUK1&hp=1&zMoatPS=Position%20Not%20Defined&zMoatST=Site%20Not%20Defined&zMoatDT=article&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863135&de=331754897285&m=0&ar=7b317f9-clean&q=4&cb=0&cu=1496926863135&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=0&d=12541037%3A369010877%3A776821277%3A98972786717&qs=1&bo=8881277&bd=118208237&gw=condenastuk573198052690&fd=1&ac=1&it=500&fs=117120&na=2034560776&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:03 GMT
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CONDEUK1&hp=1&zMoatPS=Position%20Not%20Defined&zMoatST=Site%20Not%20Defined&zMoatDT=article&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863135&de=331754897285&m=0&ar=7b317f9-clean&q=5&cb=0&cu=1496926863135&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=0&d=12541037%3A369010877%3A776821277%3A98972786717&qs=1&bo=8881277&bd=118208237&gw=condenastuk573198052690&fd=1&ac=1&it=500&fs=117120&na=1285985886&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:03 GMT
square
wi-images.condecdn.net/image/kEBZpxjaEjl/crop/200/ Frame 7775 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/kEBZpxjaEjl/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
65122f8522286c501451450d5fb0c04f8ec14549d2fa7d89c092041e2f140dc1

Request headers

:path
/image/kEBZpxjaEjl/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 16 May 2017 23:24:09 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Tue, 16 May 2017 23:24:09 GMT
server
nginx/1.11.9
age
1949814
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
kEBZpxjaEjl_200_5d0b35b6a750c28177e6554c687d2b325c06730ed79132f6f96a757d67ab72ce
cache-control
max-age=5184000
content-length
6659
x-amz-cf-id
hZIgmf9w-PbsMDdTXEjQDaRhYrkL6RxZyrt_w8pIqTqvkLTtHhmWTw==
expires
Sat, 15 Jul 2017 23:24:09 GMT
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=a75d6586-70a2-1041-da18-0d077f794c9a&tv={c:eX1G3o,pingTime:-10,time:292,type:s,mvn:ZnNjPTYsc2Q9Mixubz01,fsc:17.2.10v22222222222222020222222022222222222202002222222220022200000000000002000000002000000000002022200000000002222222022000002200020200022222000202000022202220022002022200222202222222020222200002222222200002444000400444234044442222222222022222222222202222222222222222222222222222222222220000020200002222220002222000000022200222020220002220202002000022000002200200002202200022022002000000000222222000222222220200222222202200000000022000000******1496926863455||09ac452afff7e91b5ef51d0aa9931ec2||a22a97347ed7e833c5d77acdf81f9bac||fac0c28fb7e5c4094d5e19891e6c131d||cedf07b844ac829e96b010b91e8370cb||9ad203cfa8985a4661450d9de3f2b8c2||1113dcda744a1c36d66b01844239585e||10fa3f4eca2a9ee5c4583865d2570437||1490342968,sd:MTcuMi4xMHYxNjAwfHwxMjAwfHwxNjAwfHwxMjAwfHwyNHx8MjR8fGxhbmRzY2FwZS1wcmltYXJ5fHw0LzN8fDQvM3x8MHx8MXx8MXx8MHx8MXx8MA--******1496926863457||09ac452afff7e91b5ef51d0aa9931ec2||a22a97347ed7e833c5d77acdf81f9bac||67a9bf3814411abc87ce4b754d359bb0||cedf07b844ac829e96b010b91e8370cb||9ad203cfa8985a4661450d9de3f2b8c2||1113dcda744a1c36d66b01844239585e||a9a87a648899545de426a8c9cf42dace||1490342968,no:MTcuMi4xMHZNb3ppbGxhLzUuMCAoWDExOyBMaW51eCB4ODZfNjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS81OC4wLjMwMjkuMTEwIFNhZmFyaS81MzcuMzZ8fDF8fDF8fExpbnV4IHg4Nl82NHx8bnx8MHx8R2Vja298fDIwMDMwMTA3fHxHb29nbGUgSW5jLnx8OHx8TmV0c2NhcGV8fE1vemlsbGF8fG58fG58fG4-******1496926863458||09ac452afff7e91b5ef51d0aa9931ec2||a22a97347ed7e833c5d77acdf81f9bac||1665d807618f6cde5cad211d4049d015||cedf07b844ac829e96b010b91e8370cb||9ad203cfa8985a4661450d9de3f2b8c2||1113dcda744a1c36d66b01844239585e||351e13d2fb2a611668b30b580b378ec5||1490342968}
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt65ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.11.6
click
ad.doubleclick.net/ddm/adj/N6090.2180301INFECTIOUSMEDIA-IMP/B10946462.146520476;u=idb,50510,66924,WTlKjuFddgo2GR7k;sz=728x90;kw=IDB50510,IDB66924;ord=1496926862955620364;click=http://pix.impdesk.com/ Frame 7775 		23 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N6090.2180301INFECTIOUSMEDIA-IMP/B10946462.146520476;u=idb,50510,66924,WTlKjuFddgo2GR7k;sz=728x90;kw=IDB50510,IDB66924;ord=1496926862955620364;click=http://pix.impdesk.com/click?a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms&redirect=;?
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.70 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f6.1e100.net
Software
cafe /
Resource Hash
fb7f18ace8b2fc439d948d51037f44c1612da5252c177549873c704bcc5236e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/ddm/adj/N6090.2180301INFECTIOUSMEDIA-IMP/B10946462.146520476;u=idb,50510,66924,WTlKjuFddgo2GR7k;sz=728x90;kw=IDB50510,IDB66924;ord=1496926862955620364;click=http://pix.impdesk.com/click?a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms&redirect=;?
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
ad.doubleclick.net
cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 08 Jun 2017 13:01:03 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
10176
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
surly.js
c.betrad.com/ Frame 7775 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.betrad.com/surly.js
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
3f01c1d48553b4b34257ae00e19fb344479f20aedcc33a5e67697cb1346531db

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 01 Feb 2017 20:43:22 GMT
Server
Apache
ETag
"82109c2fd348b067db5963ad7536929b:1485981802"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=3600, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1313
tfav_infectiousg_banoneinf.js
j.adlooxtracking.com/ads/js/ Frame 7775 		32 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://j.adlooxtracking.com/ads/js/tfav_infectiousg_banoneinf.js
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
37.187.148.39 , France, ASN16276 (OVH, FR),
Reverse DNS
ns344960.ip-37-187-148.eu
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
0092592c53cd2e72ed076717c4ada4ab5973eb739a634135f9ac4e9047f55835

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
j.adlooxtracking.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:05:56 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2017 12:04:54 GMT
Server
nginx/1.4.6 (Ubuntu)
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=0, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Cookie set tap.php
pixel.rubiconproject.com/ Frame 7775
Redirect Chain
  • https://pix.impdesk.com/csync/fire/provider?inc=rubicon
  • https://pixel.rubiconproject.com/tap.php?v=17913&nid=2931&put=59394a8fc1ed0a0a765029de&expires=30
 		42 B
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=17913&nid=2931&put=59394a8fc1ed0a0a765029de&expires=30
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
62.67.193.85 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
pixel.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
ses15=; vis15=36210^1; csi15=; csc15=; ruid=566e986e59394a8e94fb2daa5f70fd^1^1496926862^3162227865; rsid=DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24; ses2=36210^1; vis2=36210^1; csi2=; csc2=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Server
Rubicon Project
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie
rpb=17913%3D1; Domain=.rubiconproject.com; Expires=Sat, 08-Jul-2017 13:01:03 GMT; Path=/ rpx=17913%3D65165%2C0%2C1%2C%2C; Domain=.pixel.rubiconproject.com; Expires=Sat, 08-Jul-2017 13:01:03 GMT; Path=/ put_2931=59394a8fc1ed0a0a765029de; Domain=.rubiconproject.com; Expires=Sat, 08-Jul-2017 12:59:59 GMT; Path=/ khaos=J3OFLS75-26-D6SS; Domain=.rubiconproject.com; Expires=Fri, 08-Dec-2017 01:01:03 GMT; Path=/
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
X-RPHost
hAzABZLjYKJcdpCSYsdwww
Expires
0

Redirect headers

date
Thu, 08 Jun 2017 13:01:03 GMT
via
1.1 google
server
nginx/1.10.0 (Ubuntu)
status
302
p3p
policyref="http://pix.impdesk.com/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://pixel.rubiconproject.com/tap.php?v=17913&nid=2931&put=59394a8fc1ed0a0a765029de&expires=30
cache-control
no-cache
set-cookie
idb=WTlKj8HtCgp2UCneWTlKjz-rEcs; Path=/; Domain=impdesk.com; Expires=Tue, 03 Jul 2018 13:01:03 GMT
content-type
text/plain; charset=utf-8
alt-svc
clear
content-length
0
expires
Thu, 08 Jun 2017 13:01:03 UTC
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 7775 		24 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
jload
pixel.adsafeprotected.com/ Frame 7775 		123 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pixel.adsafeprotected.com/jload?anId=9750&campId=728x90&pubId=85336397&chanId=118208237&placementId=757020677
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
0eddfb21505cbdada300f3db1efd3d67a5ec3ef6381450cab5628239652be7ed

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
X-Server-Name
app24ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx/1.4.7
Expires
Wed, 31 Dec 1969 23:59:59 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
truncated
/ Frame 7775 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
99db9d11463162fc6fdf9f9507f700577392f68fa60325ded01cf9221c341e32

Request headers

Response headers
m_window_focus_non_hydra.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/client/ext/ Frame 7775 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/client/ext/m_window_focus_non_hydra.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ab694d75a071ce08545153773898a73588d11fe6af6d1d88f7b72f3d3da07a3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/client/ext/m_window_focus_non_hydra.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
2198
x-xss-protection
1; mode=block
server
cafe
etag
11149356827661939234
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 7775 		24 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
jload
pixel.adsafeprotected.com/ Frame 7775 		123 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pixel.adsafeprotected.com/jload?anId=9750&campId=300x600&pubId=69849197&chanId=118208237&placementId=857690837
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
cc21c5f688ca201fdb54b0329b33a26e387dd98b1eb48f51a1df89e3bec110e4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
X-Server-Name
app15ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx/1.4.7
Expires
Wed, 31 Dec 1969 23:59:59 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
truncated
/ Frame 7775 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3e84d0bb4b82f7e481943eefd64510b6e426d739cb87c430091f5ba82df0096d

Request headers

Response headers
m_window_focus_non_hydra.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/client/ext/ Frame 7775 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/client/ext/m_window_focus_non_hydra.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ab694d75a071ce08545153773898a73588d11fe6af6d1d88f7b72f3d3da07a3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/client/ext/m_window_focus_non_hydra.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
2198
x-xss-protection
1; mode=block
server
cafe
etag
11149356827661939234
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/ Frame 7775 		24 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20170605/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pagead/js/r20170605/r20110914/activeview/osd_listener.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET

Response headers

date
Tue, 06 Jun 2017 00:41:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
217148
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
9846
x-xss-protection
1; mode=block
server
cafe
etag
5368213822475282120
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 20 Jun 2017 00:41:55 GMT
jload
pixel.adsafeprotected.com/ Frame 7775 		123 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pixel.adsafeprotected.com/jload?anId=9750&campId=300x250&pubId=37412957&chanId=118208237&placementId=77042357
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
1ee34cb3f075b4b380e8f86be5edb78c261d6c35517dc17a2473ea86e79c7983

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
X-Server-Name
app18ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx/1.4.7
Expires
Wed, 31 Dec 1969 23:59:59 GMT
moatad.js
z.moatads.com/condenastuk573198052690/ Frame 7775 		199 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/condenastuk573198052690/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_121.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
z.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 May 2017 17:56:30 GMT
Server
AmazonS3
x-amz-request-id
1C5F7B0E519E93F6
ETag
"9f347d7f6f95a088c1dbd04f22ad4927"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=33509
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64891
x-amz-id-2
BGj61AR8C4RS+bFL2QFdIghoYzftJ1NU+fnk16uFdvmQShX6MrdlaJ6CoueAa5HsvYL6t1OA9kE=
truncated
/ Frame 7775 		220 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a68bb24c998d629c3b69d7548e978280e032008296bfaea6db6bc743e59652ce

Request headers

Response headers
view
securepubads.g.doubleclick.net/pcs/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsugAL3ig5spGj2f5Dv-snMCu1_327uCghmszYXi3Gp9XPkYKl6VjBu2E5TZzY2FqQUToEsG7q3sMoxtNJrVVAwADntlekOJc2ZSO6LgunbsEy_OU9P-IOqxI2Hqls8ZOEKqpcLgrIMBObL_mpfgdf1KaKBB-W7ZUR8T2HDsn9E3MTat3kH7b-_-3Bm78uw6Zqf-niE0QlgAeV4MigsPfv_F8IKOgFG3--Bb6OxGNG3HE3dhwSZ6vzysAXdjxprzthMborjOGEavalEOujtsE8EdNgA&sig=Cg0ArKJSzGapTYkNBFSXEAE&urlfix=1&adurl=
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsugAL3ig5spGj2f5Dv-snMCu1_327uCghmszYXi3Gp9XPkYKl6VjBu2E5TZzY2FqQUToEsG7q3sMoxtNJrVVAwADntlekOJc2ZSO6LgunbsEy_OU9P-IOqxI2Hqls8ZOEKqpcLgrIMBObL_mpfgdf1KaKBB-W7ZUR8T2HDsn9E3MTat3kH7b-_-3Bm78uw6Zqf-niE0QlgAeV4MigsPfv_F8IKOgFG3--Bb6OxGNG3HE3dhwSZ6vzysAXdjxprzthMborjOGEavalEOujtsE8EdNgA&sig=Cg0ArKJSzGapTYkNBFSXEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 08 Jun 2017 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
829415930798660
stats.aws.rubiconproject.com/stats/fastlaneimps/077f99d6-c116-465a-9560-ff6d2fcb4e4e/a11644/snull/znull/d/ Frame 7775 		49 B
49 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://stats.aws.rubiconproject.com/stats/fastlaneimps/077f99d6-c116-465a-9560-ff6d2fcb4e4e/a11644/snull/znull/d/829415930798660
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
54.235.172.139 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-235-172-139.compute-1.amazonaws.com
Software
Apache/2.2.3 (CentOS) /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
stats.aws.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
ses15=; vis15=36210^1; csi15=; csc15=; ruid=566e986e59394a8e94fb2daa5f70fd^1^1496926862^3162227865; rsid=DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24; ses2=36210^1; vis2=36210^1; csi2=; csc2=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Server
Apache/2.2.3 (CentOS)
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
no-cache no-cache, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
49
Expires
Mon, 01 Jun 2009 01:06:09 GMT Thu, 1 Jan 2015 00:00:00 GMT
077f99d6-c116-465a-9560-ff6d2fcb4e4e
beacon-eu2.rubiconproject.com/beacon/d/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://beacon-eu2.rubiconproject.com/beacon/d/077f99d6-c116-465a-9560-ff6d2fcb4e4e?accountId=11644&siteId=36210&zoneId=150098&e=6A1E40E384DA563BE6338ECA896F2D1452197C602FB3567F9CCE7F593AA3165FA78858AFD24BE839ECF49D54D1D19C53CAF2DAFE1CA954B3B4203C27A1E1FD8A7B011B1BCA21F3BB07348625CBA3C5ECE1D0D80E165081934CA153845BAD7E5B375D7446940F3E271A0492ECB592C69E53EEBA0CB699F81302F60EC4C3D3A3A6A674F1764D81EA18C595BA85B31CC6B54D2AC4CCDE49502A9F3FE2193D2EA893337B7A9E408EAA0A4D33117E041092C2223D14C97553177A963954ED339379FE7D8455784212ED22AC47B8BF173B877E4A7BF8B984D74C84EF4E00D898CAAADC1C13B355C0FA599D59A4C00FF0E7E8C435B6EF477B0F34CD306F80B54EB332451818FBB72091520D4A3A7165C75CE46F36ECBBC5ACEF12DF25EA5A6569C42CC015FBD1B0A13E0B47BB8BCF1368785B5407CE59ADECD48E74885DF3AE36817AF1F3C1C021A2939C7CEA9C7FF5F822D2A6448CDD4C750CF28C0D13A822C0A91FA78349516878359E5208BBF7109212F9A7DB122696F74EAB2094BD6DD8ED9D870E13E61EC2C9B80A5C5624FB404FFEBB17BC84959C800F41DCFF61DC7F39D74572DD95FE225A6BF51B42C67C70032B3B4ACB12928A5A81DED20E6C84EC969DCE0D9549943C54845FAEC3F41B76CB8D0744CD0D3C123DED166FC99F6388AA8D0BFE0919705AEB21B763ADDFD541F05778A1C0F4DDE3AA2C36B3B7A8A16C81C30F773CD5623B78073D1E0B77112C91900B76B990BB10399EAC1A179E2BD192CC0D74E8A126A4FB8BA24C5D765DF5D0A56DB0432976C4F88E414B7B10EAC6B9EFDA6340582FCE9577FB4A
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
62.67.193.23 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
beacon-eu2.rubiconproject.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
ses15=; vis15=36210^1; csi15=; csc15=; ruid=566e986e59394a8e94fb2daa5f70fd^1^1496926862^3162227865; rsid=DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24; ses2=36210^1; vis2=36210^1; csi2=; csc2=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/gif
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
img;p=11087214228308;a=11087214228978;AAID=;IDFA=;CACHEBUSTER=666238658
ad.atdmt.com/i/ Frame 7775 		42 B
51 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.atdmt.com/i/img;p=11087214228308;a=11087214228978;AAID=;IDFA=;CACHEBUSTER=666238658
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a03:2880:f01c:202:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

:path
/i/img;p=11087214228308;a=11087214228978;AAID=;IDFA=;CACHEBUSTER=666238658
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
ad.atdmt.com
cookie
ATN=1.1496926863.6507117199618308840.AYJOe4Bvxk4_XcFHKbk
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Thu, 08 Jun 2017 13:01:03 GMT
cache-control
private, no-cache, no-store, must-revalidate
expires
0
content-length
42
content-type
image/gif
view
securepubads.g.doubleclick.net/pcs/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfCd3C_Li9z-pRIJZZSnHI_vjsOHXZ4hCVT_B5nk9AtaGDRJx6UhLvk0CyYN-Y8mw6muttfUvog95ouMjZsG5nDD94z9C2hwAptbIrwqPMA3RTME8JRUsonjXMcZbrZb38Q_mkjw8cbRJQDtzX9lFmC2bP3Rrccqbzgi1dI3AtTxHDrjd5XyWP3U2UjMIv-cZI-j5tQfqdslDy1OdWCe98O8N1_hAZobBhDwyo3p1uaX3cfDZA6JtbwPBE129HsTg4oOslzZHcg4rOZ4nIPnU&sig=Cg0ArKJSzMv4JZlNW-weEAE&adurl=
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsvfCd3C_Li9z-pRIJZZSnHI_vjsOHXZ4hCVT_B5nk9AtaGDRJx6UhLvk0CyYN-Y8mw6muttfUvog95ouMjZsG5nDD94z9C2hwAptbIrwqPMA3RTME8JRUsonjXMcZbrZb38Q_mkjw8cbRJQDtzX9lFmC2bP3Rrccqbzgi1dI3AtTxHDrjd5XyWP3U2UjMIv-cZI-j5tQfqdslDy1OdWCe98O8N1_hAZobBhDwyo3p1uaX3cfDZA6JtbwPBE129HsTg4oOslzZHcg4rOZ4nIPnU&sig=Cg0ArKJSzMv4JZlNW-weEAE&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 08 Jun 2017 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
4316638208139973681
tpc.googlesyndication.com/simgad/ Frame 7775 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/4316638208139973681
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
388bcb07ac4c0c6a95dd7b8bc2d1daf52f56c1d22dbec296f24c588b1f2d5d64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/simgad/4316638208139973681
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 06 Jun 2017 08:00:22 GMT
x-content-type-options
nosniff
last-modified
Wed, 10 May 2017 10:36:05 GMT
server
sffe
age
190841
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
81777
x-xss-protection
1; mode=block
expires
Wed, 06 Jun 2018 08:00:22 GMT
l
www.google.com/ads/measurement/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.google.com/ads/measurement/l?ebcid=ALh7CaS8tot4Q_AMmX5thbpcGkm5nAhsCw13Le7QKlq5adRZ716y0MeDGPQiD02KheoC4-KOflU2e3P4I9HQFLIv6ybtTvmOlw
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
jumble_frontend_server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.google.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

X-XSS-Protection
1; mode=block
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Content-Type-Options
nosniff
Server
jumble_frontend_server
Content-Length
0
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=34&ud=0&ue=0&uu=0&qa=1600&qb=1200&qc=1&qd=1&qf=1598&qe=1132&qh=1598&qg=1198&qi=1600&qj=1200&ql=%3B%5BpwxnRd%7Dt%3Aa%5DmJVOG)%2C~%405%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(u0.pVw!ry8k.%22%3A%3DMo%5Di*3oD%5BN%7BQO%3FSFm%5D)4m3%23(%3DNRpStZ.EfoG0Kc%5ENFnUz%22uCG&qo=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&i=CONDEUK1&hp=1&zMoatPS=article-top&zMoatST=Site%20Not%20Defined&zMoatDT=article&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863521&de=338646132070&m=0&ar=7b317f9-clean&q=8&cb=0&cu=1496926863521&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=0&d=69849197%3A514398557%3A857690837%3A113493498317&qs=1&bo=8881277&bd=118208237&gw=condenastuk573198052690&fd=1&ac=1&it=500&fs=117120&na=904228008&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:03 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTbXj2JPjCu3N1GNus2Lhrd6BlL72k5SW-XS-yf-Rvlw7RF0hCZZdCsqMOErdd-NxH65SWnDVw8QvDmbNd4fCRMz_U_HxTUrdwFNY9L7NRJXk3-q44RthxG8z_hOYXLctf4BWvXe7z5_zoNnIQmTDuXqUj4R4pwF5MrFcG7a25kZM-ebaw2MDV4oNQJvoQpjneK6QxOjUgWDVl4l5XlBqvVjHnoFTs0OWBTIKdUXaUU9yqO7swdNZHNTk3VqjCHPHCxxoF_bmuV3-7PBkaxA&sig=Cg0ArKJSzJfV8uwcPADfEAE&adurl=
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.209.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
waw02s06-in-f66.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjsuTbXj2JPjCu3N1GNus2Lhrd6BlL72k5SW-XS-yf-Rvlw7RF0hCZZdCsqMOErdd-NxH65SWnDVw8QvDmbNd4fCRMz_U_HxTUrdwFNY9L7NRJXk3-q44RthxG8z_hOYXLctf4BWvXe7z5_zoNnIQmTDuXqUj4R4pwF5MrFcG7a25kZM-ebaw2MDV4oNQJvoQpjneK6QxOjUgWDVl4l5XlBqvVjHnoFTs0OWBTIKdUXaUU9yqO7swdNZHNTk3VqjCHPHCxxoF_bmuV3-7PBkaxA&sig=Cg0ArKJSzJfV8uwcPADfEAE&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
securepubads.g.doubleclick.net
cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 08 Jun 2017 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
2647905386728154264
tpc.googlesyndication.com/simgad/ Frame 7775 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/2647905386728154264
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
c9c7af72f5cedeabbf7a0bd1f8e1f4365c36809a9d7b97e969f6665a46ad1466
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/simgad/2647905386728154264
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
tpc.googlesyndication.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Wed, 24 May 2017 14:46:16 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 May 2017 14:26:39 GMT
server
sffe
age
1289687
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
18390
x-xss-protection
1; mode=block
expires
Thu, 24 May 2018 14:46:16 GMT
square
wi-images.condecdn.net/image/mZkmkJq7Q68/crop/200/ Frame 7775 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/mZkmkJq7Q68/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
70b93ab778d4a9e687810c9dc22c1572c70a665566f47f3c8ed3ba4550aee272

Request headers

:path
/image/mZkmkJq7Q68/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Fri, 26 May 2017 13:07:30 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Fri, 26 May 2017 13:07:30 GMT
server
nginx/1.11.9
age
1122813
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
mZkmkJq7Q68_200_b09e5f05780369d603298f74222649d170773f1b622663cca7275091685767b1
cache-control
max-age=5184000
content-length
10826
x-amz-cf-id
e59yP9xfHOj7svGStE8712kXrtq80nDCiEe2s1YHZ8O9UM34tUVKjw==
expires
Tue, 25 Jul 2017 13:07:30 GMT
activeview
pagead2.googlesyndication.com/ Frame 7775 		42 B
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BwIkFjko5Wd_NOs6OygXxhrqoDgAAAAAQATgByAEJwAIC4AIA4AQBoAYf0ggFCIBhEAE&cid=CAASBORob6E&id=osdim&ti=1&adk=3520868240&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&gte=108809107&tmo=4&tme=15&rtl=false&til=15&tdl=30&tdld=144&tcl=30&tcld=249&tlr=30&tlrd=144&r=u&bs=1583,1132&bos=1598,1198&ps=1583,4152&ss=1600,1200&tt=305&pt=-1&deb=1-0-5-1-2--1&tvt=289&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cd=0x0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
2a00:1450:401b:803::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CONDEUK1&hp=1&zMoatPS=article-top&zMoatST=Site%20Not%20Defined&zMoatDT=article&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&bq=0&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863521&de=338646132070&m=0&ar=7b317f9-clean&q=9&cb=0&cu=1496926863521&ll=2&lm=0&ln=1&r=25.0.0&em=0&en=0&d=69849197%3A514398557%3A857690837%3A113493498317&qs=1&bo=8881277&bd=118208237&gw=condenastuk573198052690&fd=1&ac=1&it=500&fs=117120&na=501264144&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:03 GMT
sca.17.2.10.js
cdn.adsafeprotected.com/ Frame 7775 		75 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn.adsafeprotected.com/sca.17.2.10.js
Requested by
Host: pixel.adsafeprotected.com
URL: http://pixel.adsafeprotected.com/jload?anId=9750&campId=728x90&pubId=85336397&chanId=118208237&placementId=757020677
Protocol
HTTP/1.1
Server
54.192.48.56 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-48-56.jfk5.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
03d319469fe8b4f4e92a763631f9fdad271cacc57d98484da54dcf233522a110

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
If-Modified-Since
Fri, 24 Mar 2017 08:13:19 GMT
Cache-Control
no-cache
If-Modified-Since
Fri, 24 Mar 2017 08:13:19 GMT
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Via
1.1 a81e162a9acc4a08f8778f221092bb6a.cloudfront.net (CloudFront)
Server
AmazonS3
Age
75097
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
7xoYhEukQ97vESJZf1aJGahfRKDKe6WjblaM4c1jeNOkFjNpjgk8uQ==
mon
pixel.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pixel.adsafeprotected.com/mon?anId=9750&campId=728x90&pubId=85336397&chanId=118208237&placementId=757020677&adsafe_url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&adsafe_type=abedfq&adsafe_url=https%3A%2F%2Fwww.google.ca%2F&adsafe_type=c&adsafe_jsinfo=,id:43a849e9-8cb9-1911-dcf9-72c9fa6189d7,c:eX1G6a,sl:inView,em:true,fr:true,mn:app24ami,pt:1-5-15,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,br:c,fv:25.0.0,bv:na,dm:na,abv:na,an:n,fm:qlXGzcS+111|112|12*.9750|121|13|14,idMap:12*,pl:VEBo.MZv9.jpov.0YtC.CV8L,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,uf:0,tt:jload,et:38,oid:870b1252-4c4a-11e7-abcc-00259086ca76,v:17.3.12,sp:0,ct:720,dtm:i,gtpl:0,wr:1598.1132,sr:1600.1200,mf:-2135221570,ov:0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
app24ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
express_html_inpage_rendering_lib_200_176.js
s0.2mdn.net/879366/ Frame 7775 		114 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_176.js
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2006 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
7587c0ab49ef39a7fcdb15650e1c67c298e71fe57ded6e9ec5b072c0a2780b29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/879366/express_html_inpage_rendering_lib_200_176.js
pragma
no-cache
origin
http://www.wired.co.uk
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
s0.2mdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Origin
http://www.wired.co.uk

Response headers

date
Wed, 07 Jun 2017 17:57:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
68642
status
200
alt-svc
quic=":443"; ma=2592000; v="38,37,36,35"
content-length
39838
x-xss-protection
1; mode=block
last-modified
Fri, 10 Feb 2017 12:07:26 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 08 Jun 2017 17:57:01 GMT
d5qAyLYU.js
tpc.googlesyndication.com/sodar/ Frame 7775 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://tpc.googlesyndication.com/sodar/d5qAyLYU.js
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
2a00:1450:4001:81d::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
779a80c8b614e7528f9e838b20bf3d127f78a4093959390dcb7f8d26fdac81d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
tpc.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 31 May 2017 00:55:19 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 02 Mar 2017 13:15:00 GMT
Server
sffe
Age
734744
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Length
6292
X-XSS-Protection
1; mode=block
Expires
Thu, 31 May 2018 00:55:19 GMT
ba.js
c.betrad.com/geo/ Frame 7775 		41 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.betrad.com/geo/ba.js?r170201
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
935417d579026e3876a4536bbbdbb6904f9d38b2e239681434e738daf317e14a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Tue, 25 Apr 2017 17:07:42 GMT
Server
Apache
ETag
"08652075ef02f08a974d796b254b9fc9:1493140062"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=3600, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12453
4.gif
c.betrad.com/a/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.betrad.com/a/4.gif
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
de3a7ca2f8ae592aae2652335b755b0d0b65df663dda8776387cae7339b76d64

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Last-Modified
Thu, 15 Apr 2010 17:07:29 GMT
Server
Apache
ETag
"65786c291a4603aa5150a1884452838d:1271351254"
Content-Type
image/gif
Cache-Control
max-age=3600, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=a75d6586-70a2-1041-da18-0d077f794c9a&tv={c:eX1G6B,pingTime:-2.1,time:491,type:a,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:0,o:491,n:0,pp:0,pm:0},slEvents:[{sl:o,t:30,wc:1.1.1598.1132,ac:1.1.0.0,am:i,cc:1.1.0.0,piv:NaN,obst:0,th:0,reas:l,cmps:1,bkn:{piv:[477~75],as:[477~0.0]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:116,fm:qlXGz5Y+11.9750|12*.9750|13|14|15,idMap:12.43a849e9-8cb9-1911-dcf9-72c9fa6189d7.39_9750|12*,pd:CV8L.internal-pdf-viewer,slid:[google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_7,google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_7__container__,ad_d03f7d65-f003-4097-8409-f25f8cfa5a61],avgrn:0,sinceFw:85,readyFired:true}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt42ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1G6K,pingTime:0,time:72,type:pf,env:{sf:0},rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:72,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[56~100],as:[56~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:0,fm:qlXGzcS+111|112|12*.9750|121|13|14,idMap:12*}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt38ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
mon
pixel.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pixel.adsafeprotected.com/mon?anId=9750&campId=300x600&pubId=69849197&chanId=118208237&placementId=857690837&adsafe_url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&adsafe_type=abedfq&adsafe_url=https%3A%2F%2Fwww.google.ca%2F&adsafe_type=c&adsafe_jsinfo=,id:be7fe7f0-379b-f604-85e1-588e4b62bea1,c:eX1G7m,sl:outOfView,em:true,fr:true,mn:app15ami,pt:1-2-3-4-5-6-7-8-9-10-11-12-13-14-15,wc:1.1.1598.1132,ac:1088.1018.300.600,am:i,cc:1.1.300.0,piv:19,obst:0,th:0,reas:l,cmps:1,br:c,fv:25.0.0,bv:na,dm:na,abv:na,an:n,fm:qlXGzea+111|112|121|122|123|13*.9750|14,idMap:13*,pl:VEBo.MZv9.jpov.0YtC.CV8L,rt:1,cb:0,th:0,es:1,sa:1,sc:0,ha:1,gm:1,fif:0,uf:0,tt:jload,et:31,oid:8711540c-4c4a-11e7-83f8-002590882922,v:17.3.12,sp:0,ct:792,dtm:i,gtpl:0,wr:1598.1132,sr:1600.1200,mf:2019172217,ov:0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
app28ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
sca.17.2.10.js
cdn.adsafeprotected.com/ Frame 7775 		75 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn.adsafeprotected.com/sca.17.2.10.js
Requested by
Host: pixel.adsafeprotected.com
URL: http://pixel.adsafeprotected.com/jload?anId=9750&campId=300x250&pubId=37412957&chanId=118208237&placementId=77042357
Protocol
HTTP/1.1
Server
54.192.48.56 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-48-56.jfk5.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
03d319469fe8b4f4e92a763631f9fdad271cacc57d98484da54dcf233522a110

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 09 May 2017 10:30:36 GMT
Content-Encoding
gzip
Last-Modified
Fri, 24 Mar 2017 08:13:19 GMT
Server
AmazonS3
Age
75097
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 a81e162a9acc4a08f8778f221092bb6a.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
NxWMEAOuDlrsRH1ZdPkh2TTl1SblwEWwzq81ymwn0hhlwL_I7TTEyA==
mon
pixel.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pixel.adsafeprotected.com/mon?anId=9750&campId=300x250&pubId=37412957&chanId=118208237&placementId=77042357&adsafe_url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&adsafe_type=abedfq&adsafe_url=https%3A%2F%2Fwww.google.ca%2F&adsafe_type=c&adsafe_jsinfo=,id:e32cf23f-912f-57b2-fc7e-3e9db3deceb4,c:eX1G82,sl:outOfView,em:true,fr:true,mn:app18ami,pt:1-5-15,wc:1.1.1598.1132,ac:1088.2793.300.250,am:i,cc:1.1.300.0,piv:0,obst:0,th:0,reas:l,cmps:1,br:c,fv:25.0.0,bv:na,dm:na,abv:na,an:n,fm:qlXGzeQ+111|112|121|122|123|131|14*.9750,idMap:14*,pl:VEBo.MZv9.jpov.0YtC.CV8L,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,uf:0,tt:jload,et:31,oid:87146166-4c4a-11e7-8124-0025908827f8,v:17.3.12,sp:0,ct:834,dtm:i,gtpl:0,wr:1598.1132,sr:1600.1200,mf:-617705252,ov:0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pixel.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
app32ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1G8n,pingTime:-2,time:173,type:a,sca:{avgrn1:0,dfp:{df:4,sz:728.94,dom:body}},env:{pom:1},rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:173,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[158~100],as:[158~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:0,fm:qlXGz5Y+111|112|12*.9750|121|13|14,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,pd:0YtC.internal-nacl-plugin,slid:[google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_1,google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_1__container__,ad_4954815c-c110-4f8f-bbe9-4f68bbf9532f],avgrn:0,sinceFw:134,readyFired:true}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt51ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.11.6
9im3l02I.html
tpc.googlesyndication.com/sodar/ Frame 7775 		0
0
17649.js
c.betrad.com/a/n/650/ Frame 7775 		1 KB
605 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c.betrad.com/a/n/650/17649.js
Requested by
Host: c.betrad.com
URL: https://c.betrad.com/geo/ba.js?r170201
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
ae44cce4c55f272abdfd4786bb1b5e953198cd6f9d1d309e354d7b3eb4758f55

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Fri, 27 Jan 2017 21:52:44 GMT
Server
Apache
ETag
"b12a77e0cb806653f1c597f44aca6f45:1485553964"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
605
emily.html
tap2-cdn.rubiconproject.com/partner/scripts/rubicon/ Frame 7775 		0
0
controltag
cdn.krxd.net/ Frame 7775 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/controltag?confid=rbcogou5y
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_176.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.175 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
5e507ddda723c043bcedc78b7a9958eb3e02ba9e1fff62c69ae60aa6f4110393

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
cdn.krxd.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

X-CDN-Backend
4FrRTvEr9h480D4BywjehZ--F_Config_Service_V3
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Age
1156
X-Cache
MISS, HIT, HIT
X-Request-Backend
krux_scala_config_webservice
X-App-Cache
HIT
Connection
keep-alive
Content-Length
1929
X-Served-By
config-service-a006.krxd.net, cache-iad2141-IAD, cache-fra1249-FRA
X-Response-Time
0
Accept-Ranges
bytes
X-Do-Esi
esi
Cache-Control
public, max-age=1200
X-Timer
S1496926864.848773,VS0,VE0
ETag
"767a8df511ea078ec0fe8481b210f9cac05d6e0e"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Via
1.1 varnish 1.1 varnish
Fastly-Debug-Digest
9a406b7783a1f029e76f9cfb7b27ede23696878d4eb1bdb2d21a41d0e128fbbc
X-Age
0
X-Cache-Hits
0, 2, 922
lidar.js
pagead2.googlesyndication.com/pagead/js/ Frame 7775 		78 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/js/lidar.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_176.js
Protocol
HTTP/1.1
Server
2a00:1450:401b:803::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
9760b320381e06b5405766433311259da92acb92e378ba7abfd5a9c7b655e8ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 12:42:41 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
Age
1102
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
ETag
15914873380490659771
Content-Type
text/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
29289
X-XSS-Protection
1; mode=block
Expires
Thu, 08 Jun 2017 13:42:41 GMT
index.html
s0.2mdn.net/3948241/1481725599247/728x90-flexibility/ Frame 7775 		0
0
view
googleads4.g.doubleclick.net/pcs/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst__QOrwEmUiNKh71EzjtDmwoO28d0bY5nVUCSOTweUll5MPTLC1hN-P8rcdfIwxFxY20PHiEykFR7_2yu-2iCv3_XONeWFgzTuHoRSfZSyZ9cs4oGesBJSGA&sig=Cg0ArKJSzO7a9O4367bnEAE&urlfix=1&adurl=
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.22.66 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra15s17-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/pcs/view?xai=AKAOjst__QOrwEmUiNKh71EzjtDmwoO28d0bY5nVUCSOTweUll5MPTLC1hN-P8rcdfIwxFxY20PHiEykFR7_2yu-2iCv3_XONeWFgzTuHoRSfZSyZ9cs4oGesBJSGA&sig=Cg0ArKJSzO7a9O4367bnEAE&urlfix=1&adurl=
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
googleads4.g.doubleclick.net
cookie
id=2290d2a8ad1c00a8||t=1496926863|et=730|cs=002213fd489cdff5810d0e7e85; IDE=AHWqTUljeX1OqSMaRm6pnF77RF-Z8Ev2PwvDlYwAyRWbDCKqmoe0qnNC9A
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
x-client-data
CIi2yQEIpLbJAQ==
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 08 Jun 2017 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="38,37,36,35",quic=":443"; ma=2592000; v="38,37,36,35"
content-length
0
x-xss-protection
1; mode=block
pixel
pix.impdesk.com/ Frame 7775 		43 B
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.impdesk.com/pixel?id=10551&redirect=no
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.255.114 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
114.255.178.107.bc.googleusercontent.com
Software
nginx/1.10.0 (Ubuntu) /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:path
/pixel?id=10551&redirect=no
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pix.impdesk.com
cookie
idb=WTlKj8HtCgp2UCneWTlKjz-rEcs
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:03 GMT
via
1.1 google
server
nginx/1.10.0 (Ubuntu)
vary
Origin
p3p
policyref="https://pix.impdesk.com/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
status
200
cache-control
no-cache
set-cookie
idb=WTlKj8HtCgp2UCneWTlKjz-rEcs; Path=/; Domain=impdesk.com; Expires=Tue, 03 Jul 2018 13:01:03 GMT
content-type
image/gif
alt-svc
clear
content-length
43
expires
Thu, 08 Jun 2017 13:01:03 UTC
/
rtd-tm.everesttech.net/upi/ Frame 7775
Redirect Chain
  • https://rtd.tubemogul.com/upi/?sid=wErJuM46D7a1ctlH6iei
  • https://rtd-tm.everesttech.net/upi/?sid=wErJuM46D7a1ctlH6iei
 		85 B
85 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtd-tm.everesttech.net/upi/?sid=wErJuM46D7a1ctlH6iei
Requested by
Host: www.wired.co.uk
URL: http://www.wired.co.uk/article/wanna-decryptor-ransomware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
184.73.198.237 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-184-73-198-237.compute-1.amazonaws.com
Software
Jetty(9.3.8.v20160314) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
rtd-tm.everesttech.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
everest_g_v2=g_surferid~WTlKkAAAAGgcDQ36
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-PT
P=88
P3P
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Type
image/png
Content-Length
85
Server
Jetty(9.3.8.v20160314)
Expires
Thu, 8 Jun 2017 08:01:04 -05:00

Redirect headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
Server
Jetty(9.3.8.v20160314)
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
Location
https://rtd-tm.everesttech.net/upi/?sid=wErJuM46D7a1ctlH6iei
Cache-Control
no-cache
Connection
close
Expires
Thu, 8 Jun 2017 08:01:04 -05:00
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=be7fe7f0-379b-f604-85e1-588e4b62bea1&tv={c:eX1G9y,pingTime:-2,time:166,type:a,sca:{avgrn1:0,dfp:{df:4,sz:300.604,dom:div}},env:{sf:0,pom:1},rt:1,cb:0,th:0,es:1,sa:1,sc:0,ha:1,gm:1,fif:0,slTimes:{i:0,o:166,n:0,pp:0,pm:0},slEvents:[{sl:o,t:29,wc:1.1.1598.1132,ac:1088.1018.300.600,am:i,cc:1.1.300.0,piv:19,obst:0,th:0,reas:l,cmps:1,bkn:{piv:[152~1],as:[152~300.600]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:0,fm:qlXGz5Y+111|112|12.9750|121|122|123|13*.9750|14.9750,idMap:13*,pd:jpov.libwidevinecdmadapter.so,slid:[google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_2,google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_2__container__,ad_c7462027-9453-4fcb-acbc-7471895bff5e],avgrn:0,sinceFw:133,readyFired:true}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt33ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1Gaf,pingTime:-10,time:289,type:s,mvn:ZnNjPTYsc2Q9Mixubz01,fsc:17.2.10v22222222222222020222222022222222222202002222222220022200000000000002000000002000000000002022200000000002222222022000002200020200022222000202000022202220022002022200222202222222020222200002222222200002444000400444234044442222222222022222222222202222222222222222222222222222222222220000020200002222220002222000000022200222020220002220202002000022000002200200002202200022022002000000000222222000222222220200222222202200000000022000000******1496926863879||ee14df66569b402265bb71b33a39672f||a22a97347ed7e833c5d77acdf81f9bac||ceaf0a2d4aff4c8c26d3757b7abae36a||aa3f36e0fb96bc57e5a7b66e29a0c4e1||0c57b49a97d2da05404a604038391136||fadd4634a46404bc416a61ad977bb215||e8638a876848b6d77439eb8958ff6138||1490342968,sd:MTcuMi4xMHYxNjAwfHwxMjAwfHwxNjAwfHwxMjAwfHwyNHx8MjR8fGxhbmRzY2FwZS1wcmltYXJ5fHw0LzN8fDQvM3x8MHx8MXx8MXx8MHx8MXx8MA--******1496926863881||ee14df66569b402265bb71b33a39672f||a22a97347ed7e833c5d77acdf81f9bac||e68afddd51617ea2075b3f30b149d0f8||aa3f36e0fb96bc57e5a7b66e29a0c4e1||0c57b49a97d2da05404a604038391136||fadd4634a46404bc416a61ad977bb215||b68c444257d50ab5885e49df600346a9||1490342968,no:MTcuMi4xMHZNb3ppbGxhLzUuMCAoWDExOyBMaW51eCB4ODZfNjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS81OC4wLjMwMjkuMTEwIFNhZmFyaS81MzcuMzZ8fDF8fDF8fExpbnV4IHg4Nl82NHx8bnx8MHx8R2Vja298fDIwMDMwMTA3fHxHb29nbGUgSW5jLnx8OHx8TmV0c2NhcGV8fE1vemlsbGF8fG58fG58fG4-******1496926863882||ee14df66569b402265bb71b33a39672f||a22a97347ed7e833c5d77acdf81f9bac||967bde6313cac1173fc19ad41c899adf||aa3f36e0fb96bc57e5a7b66e29a0c4e1||0c57b49a97d2da05404a604038391136||fadd4634a46404bc416a61ad977bb215||49ed1a021618a30f93d86e481c8e63cf||1490342968}
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt36ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=e32cf23f-912f-57b2-fc7e-3e9db3deceb4&tv={c:eX1Gam,pingTime:-2,time:174,type:a,im:{pBlk:43,pLoad:69},sca:{avgrn1:0,dfp:{df:4,sz:300.254,dom:div}},env:{sf:0,pom:1},rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:0,o:175,n:0,pp:0,pm:0},slEvents:[{sl:o,t:29,wc:1.1.1598.1132,ac:1088.2793.300.250,am:i,cc:1.1.300.0,piv:0,obst:0,th:0,reas:l,cmps:1,bkn:{piv:[161~0],as:[161~300.250]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:0,fm:qlXGz5Y+111|112|12.9750|121|122|123|13.9750|131|14*.9750,idMap:14*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,slid:[google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_3,google_ads_iframe_/5574/uk.n5574.wired/business-politics/articles_3__container__,ad_a3356501-e27a-4c13-ac01-45bbd0cacf75],avgrn:0,sinceFw:142,readyFired:true}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:03 GMT
X-Server-Name
dt27ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.11.6
ic.php
data04.adlooxtracking.com/ads/ Frame 7775 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://data04.adlooxtracking.com/ads/ic.php?adloox_transaction_id=WTlKjuFddgo2GR7k&bp=&visite_id=89197811958&client=infectious&ctitle=&id_editeur=WTlKjuFddgo2GR7k_ADLOOX_ID_66924_ADLOOX_ID_728x90_ADLOOX_ID_2_ADLOOX_ID_50510_ADLOOX_ID_424347_ADLOOX_ID_11644_ADLOOX_ID_36210%2F150098_ADLOOX_ID_578045_ADLOOX_ID_deu&banniere=banoneinf&campagne=infectiousg&os=&navigateur=&appname=Netscape&timezone=0&fai=rpfl_11644__5574_uk_n5574_wired_business_politics_articles_2%40http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&alerte=&alerte_desc=&data=-932555300tttttttffffffffttfffffffffffttfff&js=undefined&fw=1&version=2&iframe=3&hadnxs=&plat=0&ua=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F58.0.3029.110%20Safari%2F537.36&url_referrer=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&resolution=1600x1200&nb_cpu=8&nav_lang=en-US&date_regen=2017-03-20%2016%3A11%3A39&ao=http%3A%2F%2Fwww.wired.co.uk&fake=010000&popup=none&p_d=330
Requested by
Host: j.adlooxtracking.com
URL: http://j.adlooxtracking.com/ads/js/tfav_infectiousg_banoneinf.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
149.202.93.239 , France, ASN16276 (OVH, FR),
Reverse DNS
ndata04.adlooxtracking.com
Software
nginx/1.4.6 (Ubuntu) / PHP/5.5.9-1ubuntu4.21
Resource Hash
8f7b22328ad3116b976f52e10c243761ada4d562e1e10762340517b95f94b737

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
data04.adlooxtracking.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:04 GMT
Content-Encoding
gzip
Timing-Allow-Origin
*
X-Powered-By
PHP/5.5.9-1ubuntu4.21
Transfer-Encoding
chunked
Connection
keep-alive
Pragma
no-cache
Last-Modified
Thu, 08 Jun 2017 13:01:04 GMT
Server
nginx/1.4.6 (Ubuntu)
Vary
Accept-Encoding
Content-Type
text/javascript;charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Access-Control-Allow-Credentials
true
X-Robots-Tag
noindex, nofollow
Expires
Mon, 26 Jul 1997 05:00:00 GMT
inc
pix.impdesk.com/ Frame 7775 		43 B
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.impdesk.com/inc?m=ci_view&a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.255.114 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
114.255.178.107.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:path
/inc?m=ci_view&a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pix.impdesk.com
cookie
idb=WTlKj8HtCgp2UCneWTlKjz-rEcs
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:03 GMT
via
1.1 google
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
set-cookie
idb=WTlKj8HtCgp2UCneWTlKjz-rEcs; Path=/; Domain=impdesk.com; Expires=Tue, 03 Jul 2018 13:01:03 GMT
alt-svc
clear
content-length
43
expires
Thu, 08 Jun 2017 13:01:03 UTC
controltag.js.8fe8c1d684cb27229b236f8a288e567b
cdn.krxd.net/ctjs/ Frame 7775 		233 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn.krxd.net/ctjs/controltag.js.8fe8c1d684cb27229b236f8a288e567b
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag?confid=rbcogou5y
Protocol
HTTP/1.1
Server
151.101.12.175 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
eb938e52c8333f8339aefd26a55019ad44c03c6d214b8fcf7ef5f8893e103cfd

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
cdn.krxd.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

X-CDN-Backend
4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
Date
Thu, 08 Jun 2017 13:01:03 GMT
Content-Encoding
gzip
Age
156647
X-Cache
HIT
X-Cache-Hits
965879
Connection
keep-alive
Content-Length
75631
X-Served-By
cache-fra1221-FRA
Last-Modified
Tue, 06 Jun 2017 17:19:32 GMT
X-Timer
S1496926864.987622,VS0,VE0
ETag
"8fe8c1d684cb27229b236f8a288e567b"
Content-Type
application/javascript
Via
1.1 varnish
Cache-Control
public, max-age=315360000
Accept-Ranges
bytes
Expires
Fri, 04 Jun 2027 17:19:31 GMT
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=e32cf23f-912f-57b2-fc7e-3e9db3deceb4&tv={c:eX1GcK,pingTime:-10,time:322,type:s,mvn:ZnNjPTYsc2Q9Mixubz01,fsc:17.2.10v22222222222222020222222022222222222202002222222220022200000000000002000000002000000000002022200000000002222222022000002200020200022222000202000022202220022002022200222202222222020222200002222222200002444000400444234044442222222222022222222222202222222222222222222222222222222222220000020200002222220002222000000022200222020220002220202002000022000002200200002202200022022002000000000222222000222222220200222222202200000000022000000******1496926864032||f845a3ec3a9d5d555f12f0137a9b3fab||a22a97347ed7e833c5d77acdf81f9bac||acec6e8c0af97ddbdc75bb2e534b1533||e26016e0d187b67ad2f0913fb46bfff3||80b34cae1a0c4810ea91821a2555ca90||e67cf9542d5b66623b244ae8f0410277||851edda15a1c01dfb84e2be5a3b8333d||1490342968,sd:MTcuMi4xMHYxNjAwfHwxMjAwfHwxNjAwfHwxMjAwfHwyNHx8MjR8fGxhbmRzY2FwZS1wcmltYXJ5fHw0LzN8fDQvM3x8MHx8MXx8MXx8MHx8MXx8MA--******1496926864035||f845a3ec3a9d5d555f12f0137a9b3fab||a22a97347ed7e833c5d77acdf81f9bac||6423115043ae1ab543063eb2effd78ea||e26016e0d187b67ad2f0913fb46bfff3||80b34cae1a0c4810ea91821a2555ca90||e67cf9542d5b66623b244ae8f0410277||41d094e9112b4192e9ea27d18c2c8ef3||1490342968,no:MTcuMi4xMHZNb3ppbGxhLzUuMCAoWDExOyBMaW51eCB4ODZfNjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS81OC4wLjMwMjkuMTEwIFNhZmFyaS81MzcuMzZ8fDF8fDF8fExpbnV4IHg4Nl82NHx8bnx8MHx8R2Vja298fDIwMDMwMTA3fHxHb29nbGUgSW5jLnx8OHx8TmV0c2NhcGV8fE1vemlsbGF8fG58fG58fG4-******1496926864037||f845a3ec3a9d5d555f12f0137a9b3fab||a22a97347ed7e833c5d77acdf81f9bac||4922e033765944b5eb4732e120acd0c6||e26016e0d187b67ad2f0913fb46bfff3||80b34cae1a0c4810ea91821a2555ca90||e67cf9542d5b66623b244ae8f0410277||d950b1d7e343bfb4a533a6b89b86d6a0||1490342968}
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-Server-Name
dt33ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&kq=1&lo=1&qs=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F4316638208139973681&i=CONDEUK1&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&h=600&w=300&fy=0&gp=0&zMoatPS=article-top&zMoatST=Site%20Not%20Defined&zMoatDT=article&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863521&de=338646132070&cu=1496926863521&m=566&ar=7b317f9-clean&cb=0&ll=2&lm=0&ln=1&r=25.0.0&dl=0&dm=1000&dn=66&gh=1&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1598&qe=1132&qh=1598&qg=1198&lk=undefined&lb=4152&le=1&gm=1&io=1&ch=0&as=0&ag=0&an=0&gf=0&gg=0&ez=1&pg=19&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&im=0&em=0&en=0&bu=122&cd=0&ah=122&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=69849197%3A514398557%3A857690837%3A113493498317&bo=8881277&bd=118208237&gw=condenastuk573198052690&ab=1&ac=1&fd=1&kt=strict&it=500&fs=117120&na=653657488&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:04 GMT
ic3.php
data04.adlooxtracking.com/ads/ Frame 7775 		358 B
370 B 		Script
General
Check archive.org
Download Go to
Full URL
http://data04.adlooxtracking.com/ads/ic3.php?fw=1&iframe=3&version=2&client=infectious&banniere=banoneinf&id_editeur=WTlKjuFddgo2GR7k_ADLOOX_ID_66924_ADLOOX_ID_728x90_ADLOOX_ID_2_ADLOOX_ID_50510_ADLOOX_ID_424347_ADLOOX_ID_11644_ADLOOX_ID_36210%2F150098_ADLOOX_ID_578045_ADLOOX_ID_deu&campagne=infectiousg&methode=%3B&fai=rpfl_11644__5574_uk_n5574_wired_business_politics_articles_2%40http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&url_referrer=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&ads_forceblock=1&log=1&visite_id=89197811958&alerte_desc=content:virus
Requested by
Host: data04.adlooxtracking.com
URL: https://data04.adlooxtracking.com/ads/ic.php?adloox_transaction_id=WTlKjuFddgo2GR7k&bp=&visite_id=89197811958&client=infectious&ctitle=&id_editeur=WTlKjuFddgo2GR7k_ADLOOX_ID_66924_ADLOOX_ID_728x90_ADLOOX_ID_2_ADLOOX_ID_50510_ADLOOX_ID_424347_ADLOOX_ID_11644_ADLOOX_ID_36210%2F150098_ADLOOX_ID_578045_ADLOOX_ID_deu&banniere=banoneinf&campagne=infectiousg&os=&navigateur=&appname=Netscape&timezone=0&fai=rpfl_11644__5574_uk_n5574_wired_business_politics_articles_2%40http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&alerte=&alerte_desc=&data=-932555300tttttttffffffffttfffffffffffttfff&js=undefined&fw=1&version=2&iframe=3&hadnxs=&plat=0&ua=Mozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F58.0.3029.110%20Safari%2F537.36&url_referrer=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&resolution=1600x1200&nb_cpu=8&nav_lang=en-US&date_regen=2017-03-20%2016%3A11%3A39&ao=http%3A%2F%2Fwww.wired.co.uk&fake=010000&popup=none&p_d=330
Protocol
HTTP/1.1
Server
149.202.93.239 , France, ASN16276 (OVH, FR),
Reverse DNS
ndata04.adlooxtracking.com
Software
nginx/1.4.6 (Ubuntu) / PHP/5.5.9-1ubuntu4.21
Resource Hash
da0f33b8ac9b94b5f21dff3b54ce2ecdb781d694510569cac41dfb26adbb8956

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
data04.adlooxtracking.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:05 GMT
Last-Modified
Thu, 08 Jun 2017 13:01:05 GMT
Server
nginx/1.4.6 (Ubuntu)
X-Powered-By
PHP/5.5.9-1ubuntu4.21
X-Robots-Tag
noindex, nofollow
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Cookie set ad_impression.gif
beacon.krxd.net/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://beacon.krxd.net/ad_impression.gif?confid=rbcogou5y&advertiserid=3948241&campaignid=10946462&adid=318064828&siteid=2457023&placementid=146520476&creativeid=77371977&url=%2F%2Fbeacon.krxd.net%2Fad_impression.gif&_kpid=3d8e4b51-b537-4841-9086-4f59862457c6
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
46.137.181.13 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-137-181-13.eu-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
beacon.krxd.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:04 GMT
Server
Apache
P3P
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
Set-Cookie
_kuid_=LTH669a9; path=/; expires=Tue, 05-Dec-17 13:01:04 GMT; domain=.krxd.net
Cache-Control
private, no-cache, no-store
X-Request-Time
D=305 t=1496926864073358
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
X-Served-By
beacon-a224-dub.krxd.net
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=e32cf23f-912f-57b2-fc7e-3e9db3deceb4&tv={c:eX1GkO,time:822,type:e,im:{pWait:80},rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:0,o:822,n:0,pp:0,pm:0},slEvents:[{sl:o,t:29,wc:1.1.1598.1132,ac:1088.2793.300.250,am:i,cc:1.1.300.0,piv:0,obst:0,th:0,reas:l,cmps:1,bkn:{piv:[808~0],as:[808~300.250]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:408,fm:qlXGz5Y+111|112|12.9750|121|122|123|13.9750|131|14*.9750,idMap:14*,avgrn:0}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.11.6 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-Server-Name
dt30ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.11.6
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1GmU,pingTime:1,time:1074,type:p,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:1074,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[1058~100],as:[1058~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:104,fm:qlXGz5Y+111|112|12*.9750|121|13.9750|14.9750,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,avgrn:0}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-Server-Name
dt43ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1GmV,pingTime:1,time:1075,type:pf,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:1075,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[1059~100],as:[1059~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:104,fm:qlXGz5Y+111|112|12*.9750|121|13.9750|14.9750,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,avgrn:0}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-Server-Name
dt44ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1GmW,pingTime:1,time:1076,type:c,clog:[{piv:100,vs:i,r:,w:728,h:90,t:36}],rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:1076,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[1060~100],as:[1060~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:104,fm:qlXGz5Y+111|112|12*.9750|121|13.9750|14.9750,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,avgrn:0,metricId:publ1}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-Server-Name
dt42ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1GmW,pingTime:1,time:1076,type:c,clog:[{piv:100,vs:i,r:,w:728,h:90,t:36}],rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:1076,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[1060~100],as:[1060~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:104,fm:qlXGz5Y+111|112|12*.9750|121|13.9750|14.9750,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,avgrn:0,metricId:grpm1}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:04 GMT
X-Server-Name
dt43ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
COMMON.css
c.betrad.com/a/ Frame 7775 		2 KB
715 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c.betrad.com/a/COMMON.css?r=0.9391846304347697
Requested by
Host: c.betrad.com
URL: https://c.betrad.com/geo/ba.js?r170201
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
a3c92e8d35e4e636238e577da8cd44aaf8dd699b719e4125ba0029330edf6907

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:04 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Feb 2017 16:26:10 GMT
Server
Apache
ETag
"c3cc19ce8230df99c7835decc2d79ee8:1486052770"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
715
box_77_top-right.png
c.betrad.com/icon/ Frame 7775 		159 B
159 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.betrad.com/icon/box_77_top-right.png
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
18ce127fac997d05e6cac7436df99fe45e8a589d26d1c891aa127e8b2af572a1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:04 GMT
Last-Modified
Wed, 06 Feb 2013 22:25:19 GMT
Server
Apache
ETag
"49829da8a0a594f300b83586f077bf58:1360189519"
Content-Type
image/png
Cache-Control
max-age=3600, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
159
c_90_us.png
c.betrad.com/icon/ Frame 7775 		925 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.betrad.com/icon/c_90_us.png
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.189.14 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-189-14.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
142b5afce831d3b6dae5351b495ddc47681f8d9a91eaf4fb4589f7975174bdaa

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
c.betrad.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:04 GMT
Last-Modified
Wed, 06 Feb 2013 22:25:44 GMT
Server
Apache
ETag
"9154bd4f142cbc3919dffd2bb4b58372:1360189544"
Content-Type
image/png
Cache-Control
max-age=3600, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
925
pixel.gif
l.betrad.com/ct/0_0_0_17649/de/0/1/0/0/0/0/728/90/242/650/0/ Frame 7775 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/ct/0_0_0_17649/de/0/1/0/0/0/0/728/90/242/650/0/pixel.gif?v=2_1&ttid=2&d=www.wired.co.uk&r=0.2195198199868893
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.88.53.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-88-53-255.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path
/ct/0_0_0_17649/de/0/1/0/0/0/0/728/90/242/650/0/pixel.gif?v=2_1&ttid=2&d=www.wired.co.uk&r=0.2195198199868893
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
l.betrad.com
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

status
204
date
Thu, 08 Jun 2017 13:01:05 GMT
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
optout_check
beacon.krxd.net/ Frame 7775 		89 B
89 B 		Script
General
Check archive.org
Download Go to
Full URL
http://beacon.krxd.net/optout_check?callback=Krux.ns.expedia.kxjsonp_optOutCheck
Requested by
Host: cdn.krxd.net
URL: http://cdn.krxd.net/ctjs/controltag.js.8fe8c1d684cb27229b236f8a288e567b
Protocol
HTTP/1.1
Server
46.137.181.13 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-137-181-13.eu-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
c5050ac31a6a934d14104feb6bcbba3711b384574deb4af319c8c7b009b88588

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
beacon.krxd.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_kuid_=LTH669a9
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Thu, 08 Jun 2017 13:01:04 GMT
Server
Apache
P3P
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
Cache-Control
private, max-age=0, s-max-age=0
X-Request-Time
D=211 t=1496926864402897
Connection
keep-alive
Content-Type
text/javascript
Content-Length
89
X-Served-By
beacon-a214-dub.krxd.net
favicon.ico
www.wired.co.uk/static/icons/ Frame 7775 		1 KB
560 B 		Other
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/icons/favicon.ico
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
4264ac5aef251823acda796ee6213807514ad4fd8642200631635b6e310b9a73

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_ga=GA1.3.661310791.1496926863; _gid=GA1.3.1375290225.1496926863; _gat_TRACKER0=1; _gat_TRACKER1=1; __gads=ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw; kxexpedia_data=cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A1496928664492%3Bfp%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_fp%3A1512478864493%3Bvisits%3A1%3B_visits%3A1496966400000
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Fri, 05 May 2017 12:31:43 GMT
Content-Encoding
gzip
Age
583
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Tue, 22 Nov 2016 15:49:05 GMT
Server
nginx
ETag
W/"583468f1-47e"
Vary
Accept-Encoding
Content-Type
image/x-icon
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Cache-Control
max-age=900 public
X-Amz-Cf-Id
pc7caDpvuNdhYYJO7ApmSdwrNhosyn9Q5E_-XZUmTdva44trK_4bTw==
Expires
Fri, 05 May 2017 12:46:43 GMT
square
wi-images.condecdn.net/image/E2WGeBG62LO/crop/200/ Frame 7775 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/E2WGeBG62LO/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
9418b1be59b2c83ddde4ad2a65a4f04d87d6074c3cb7af5bda9ca1bab6aedb20

Request headers

:path
/image/E2WGeBG62LO/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Wed, 07 Jun 2017 14:34:06 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Wed, 07 Jun 2017 14:34:06 GMT
server
nginx/1.11.9
age
80818
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
E2WGeBG62LO_200_71b4787e3acc53b242fa794132eda7ce165f55ad161e1e5bfce31bca14b3d692
cache-control
max-age=5184000
content-length
6993
x-amz-cf-id
ZO41N2s_eeI-gx8oxvnNBAlzCJWHmfFUdkV89LWjFMGWuqjmua1GNQ==
expires
Sun, 06 Aug 2017 14:34:06 GMT
square
wi-images.condecdn.net/image/m4xR5WRALAd/crop/200/ Frame 7775 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wi-images.condecdn.net/image/m4xR5WRALAd/crop/200/square
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:201b:4e00:b:ece0:3340:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.11.9 /
Resource Hash
aace23a5db8d32842266843af7466468690e08e96e376c6bbfc452d2178e597e

Request headers

:path
/image/m4xR5WRALAd/crop/200/square
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
wi-images.condecdn.net
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:scheme
https
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Tue, 16 May 2017 10:12:57 GMT
via
1.1 6f099059f3f75b21b2f0000c8a1b711c.cloudfront.net (CloudFront)
x-conde-cache
hit
last-modified
Tue, 16 May 2017 10:12:57 GMT
server
nginx/1.11.9
age
1997287
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-conde-cache-key
m4xR5WRALAd_200_4f3534cf8aee12e7ef92ae6969ee2116cd1d4ef5ca31784e4b46b6e41611ee44
cache-control
max-age=5184000
content-length
12492
x-amz-cf-id
7EvYEBfEAzggXgHKG9Nens9khjVxHvK7o2c5_MkVDWPrU-McmoTNHg==
expires
Sat, 15 Jul 2017 10:12:57 GMT
favicon-16x16.png
www.wired.co.uk/static/icons/ Frame 7775 		403 B
403 B 		Other
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/icons/favicon-16x16.png
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
54184ed178682c22a6a30a1f76127697d3768ce2b488fe77948a1a3e68c1b70a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_ga=GA1.3.661310791.1496926863; _gid=GA1.3.1375290225.1496926863; _gat_TRACKER0=1; _gat_TRACKER1=1; __gads=ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw; kxexpedia_data=cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A1496928664492%3Bfp%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_fp%3A1512478864493%3Bvisits%3A1%3B_visits%3A1496966400000%3Buser%3Arwesgqt6n%3B_user%3A1512478864881%3Bkuid%3ALTH669a9%3B_kuid%3A1512478864881
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
public
Date
Sat, 04 Mar 2017 05:38:27 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Tue, 22 Nov 2016 15:49:05 GMT
Server
nginx
Age
518
ETag
"583468f1-193"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
403
X-Amz-Cf-Id
9za3bUrmnWC4VO01qZZzs07piDmxR94qkQM1vmondSwx3xIGDm7oLA==
Expires
Sat, 04 Mar 2017 05:53:27 GMT
favicon-96x96.png
www.wired.co.uk/static/icons/ Frame 7775 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/icons/favicon-96x96.png
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
0c2f052aa3dd4d01adb7d1342a206348a569d74c32ca5df3f214d5788903c67f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_ga=GA1.3.661310791.1496926863; _gid=GA1.3.1375290225.1496926863; _gat_TRACKER0=1; _gat_TRACKER1=1; __gads=ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw; kxexpedia_data=cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A1496928664492%3Bfp%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_fp%3A1512478864493%3Bvisits%3A1%3B_visits%3A1496966400000%3Buser%3Arwesgqt6n%3B_user%3A1512478864881%3Bkuid%3ALTH669a9%3B_kuid%3A1512478864881
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
public
Date
Sat, 04 Mar 2017 02:26:42 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Tue, 22 Nov 2016 15:49:05 GMT
Server
nginx
Age
517
ETag
"583468f1-723"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1827
X-Amz-Cf-Id
_ygWj0xQ-R7euBzlCUYo45ukdsWkY7bsHSf_moHX4w9TRbxXW3BG6A==
Expires
Sat, 04 Mar 2017 02:41:42 GMT
favicon-32x32.png
www.wired.co.uk/static/icons/ Frame 7775 		704 B
704 B 		Other
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/icons/favicon-32x32.png
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b2347e897675c8c16b970dc27135b1ec5aa29c0a28f81fd324855923cd55c461

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_ga=GA1.3.661310791.1496926863; _gid=GA1.3.1375290225.1496926863; _gat_TRACKER0=1; _gat_TRACKER1=1; __gads=ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw; kxexpedia_data=cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A1496928664492%3Bfp%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_fp%3A1512478864493%3Bvisits%3A1%3B_visits%3A1496966400000%3Buser%3Arwesgqt6n%3B_user%3A1512478864881%3Bkuid%3ALTH669a9%3B_kuid%3A1512478864881
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
public
Date
Sat, 04 Mar 2017 04:32:09 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Tue, 22 Nov 2016 15:49:05 GMT
Server
nginx
Age
517
ETag
"583468f1-2c0"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
704
X-Amz-Cf-Id
n3t-e_Z0RENljYmloGFl4SORJyVegrPHZpT4B0TfoN-gCaNy1Nnxrw==
Expires
Sat, 04 Mar 2017 04:47:09 GMT
android-icon-192x192.png
www.wired.co.uk/static/icons/ Frame 7775 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://www.wired.co.uk/static/icons/android-icon-192x192.png
Protocol
HTTP/1.1
Server
2600:9000:2041:9e00:f:4ddd:5d80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
80494f8c23ca7839948bfe1c5d5e85938d8377cc5ac69fb99909ef7dfa9c6180

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.wired.co.uk
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Cookie
_ga=GA1.3.661310791.1496926863; _gid=GA1.3.1375290225.1496926863; _gat_TRACKER0=1; _gat_TRACKER1=1; __gads=ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw; kxexpedia_data=cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A1496928664492%3Bfp%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_fp%3A1512478864493%3Bvisits%3A1%3B_visits%3A1496966400000%3Buser%3Arwesgqt6n%3B_user%3A1512478864881%3Bkuid%3ALTH669a9%3B_kuid%3A1512478864881
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
public
Date
Fri, 21 Apr 2017 11:52:49 GMT
Via
1.1 894df773e6d6d77dd4e14c3435f2f68d.cloudfront.net (CloudFront)
Last-Modified
Tue, 22 Nov 2016 15:49:05 GMT
Server
nginx
Age
146
ETag
"583468f1-1096"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
max-age=900 public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4246
X-Amz-Cf-Id
9X2HDWsN1YzABQTxYJIVCaz7mRWyl_Y8EvweqyD-thAcGFWV1dMiBg==
Expires
Fri, 21 Apr 2017 12:07:49 GMT
inc
pix.impdesk.com/ Frame 7775 		43 B
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.impdesk.com/inc?m=view&a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.255.114 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
114.255.178.107.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:path
/inc?m=view&a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pix.impdesk.com
cookie
idb=WTlKj8HtCgp2UCneWTlKjz-rEcs
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:05 GMT
via
1.1 google
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
set-cookie
idb=WTlKj8HtCgp2UCneWTlKkcWkLKg; Path=/; Domain=impdesk.com; Expires=Tue, 03 Jul 2018 13:01:05 GMT
alt-svc
clear
content-length
43
expires
Thu, 08 Jun 2017 13:01:05 UTC
activeview
pagead2.googlesyndication.com/ Frame 7775 		42 B
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagead2.googlesyndication.com/activeview?avi=BDWm4j0o5WcqnC9GQygWsj7_YCQAAAAAQATgByAEJwAIC4AIA4AQBoAYW0ggFCIBhEAE&cid=CAASEuRoJ2dia5mORL8HPnneHk245g&id=osdim&ti=1&adk=2311815512&mtos=1109,1109,1109,1109,1109&tos=1109,0,0,0,0&p=280,428,370,1156&mcvt=1109&rs=3&ht=0&tfs=1596&tls=2705&mc=1&lte=1&bas=0&bac=0&gte=108809107&tmo=305&tme=1595&rtl=false&til=1595&tdl=507&tdld=255&tcl=1600&tcld=6&tlr=507&tlrd=255&r=u&bs=1583,1132&bos=1598,1198&ps=1583,4152&ss=1600,1200&tt=1006&pt=1699&deb=1-5-5-9-15-4&tvt=2689&avms=geo&uc=5&tgt=IFRAME&cl=1&cec=6&clc=1&cd=728x90
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
2a00:1450:401b:803::2002 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pagead2.googlesyndication.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:05 GMT
X-Content-Type-Options
nosniff
Server
cafe
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, must-revalidate
Timing-Allow-Origin
*
Content-Length
42
X-XSS-Protection
1; mode=block
Expires
Fri, 01 Jan 1990 00:00:00 GMT
inc
pix.impdesk.com/ Frame 7775 		43 B
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pix.impdesk.com/inc?m=e_view&a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.255.114 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
114.255.178.107.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:path
/inc?m=e_view&a=-jozo5YpgZFrNAhgW1VjvCUIZrrrb0zGRlNLdPWnJh-3RsWyn0WQzzAKvxh-ensBN0nCCQGPpW_FZ9dEBVCj37vRV-RzHyb4MWOjVYiz2Ey5fwVgOTChzPU-sKKowJ1pflLz31Q3K8V4manPFDfMzYHWCJnyDwkEehHu77cT6a5mU0uTQ2bDIOXOm6MM9-K8rgsfjC7RZMelSfE2eSZQDQdJ-C1AYR6O_s2NpabTA9wj9dEC_3CAPZW460FlgPQG7ZSJXXJwvT2aJNurqFLN1YyukhVc5XBhwg8Z9UfLKnC1ACQhhDwraGxR2yEjuTDm3mYf6RCmiknn3b0SjyZWbsx0mYYAO__9jFLfqYGX6zZtqW-kmBMA9NZhFfzvtpFHkDPVfqCzHeKxm1I1IK-k4qQ-hV6PffBB9Ms
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pix.impdesk.com
cookie
idb=WTlKj8HtCgp2UCneWTlKkcWkLKg
:scheme
https
referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
:method
GET
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Thu, 08 Jun 2017 13:01:07 GMT
via
1.1 google
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
set-cookie
idb=WTlKj8HtCgp2UCneWTlKkyuqTYQ; Path=/; Domain=impdesk.com; Expires=Tue, 03 Jul 2018 13:01:07 GMT
alt-svc
clear
content-length
43
expires
Thu, 08 Jun 2017 13:01:07 UTC
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1Hpq,pingTime:5,time:5074,type:p,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:5075,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[5059~100],as:[5059~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:40,fm:qlXGz5Y+111|112|12*.9750|121|13.9750|14.9750,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,avgrn:0}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:08 GMT
X-Server-Name
dt32ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
dt
dt.adsafeprotected.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.adsafeprotected.com/dt?anId=9750&asId=43a849e9-8cb9-1911-dcf9-72c9fa6189d7&tv={c:eX1Hpr,pingTime:5,time:5075,type:pf,rt:1,cb:0,th:0,es:0,sa:1,sc:1,ha:1,gm:1,fif:0,slTimes:{i:5075,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:35,wc:1.1.1598.1132,ac:429.281.728.90,am:i,cc:1.1.728.94,piv:100,obst:0,th:0,reas:,cmps:1,bkn:{piv:[5059~100],as:[5059~728.90]}}],slEventCount:1,em:true,fr:true,uf:0,e:,tt:jload,dtt:40,fm:qlXGz5Y+111|112|12*.9750|121|13.9750|14.9750,idMap:12.a75d6586-70a2-1041-da18-0d077f794c9a.106_9750|12*,avgrn:0}&br=c
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx/1.4.7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dt.adsafeprotected.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:08 GMT
X-Server-Name
dt32ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx/1.4.7
pixel.gif
px.moatads.com/ Frame 7775 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&kq=1&lo=1&qs=1&ak=-&i=CONDEUK1&ud=0&ue=0&uu=0&qm=0&qn=6OZw%3DoHB%2CEF%3FKC1I%3Cq.bWoCSV2W0Su*TDXlCfX2iR2%25(GyHN%3DI(%2C%3Ba15lK1t!9Zp%7Bl.I6%3DT103etW6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo8rY2baurI!tzm!jVSn%3CV%3CTZ8!J%3BatASYUby%3D(tN%23V.x1.qUD%60aFjL%2FX%252%3B(OC)Lp%22%3Fj3VYUex8k%40%22%7Cu7pRB%5Bz%26(K%2BxP%25l7g%26kyM8F4%2BKCCRP)Et%5B%40(X%7C01%5B_)vVS%2F%2F.hX%3Dt%3C!T%5D%3DNMV8t8fvb%26%225gRo%2BG%22IQ3qC%60I4%3CeZl%5DM%3ArRaxDmPN0%2FdEGm(tVDU%3CVZvoJU4b6W%3AGHBx%3Df%5E7j%22R%5EIc%2CDT%24F%26(%26u3Rs%3C%5ECPR9%6013s%40.Y_hmP%3BgsJ%24Ym%24%2FjkkeL07ta_*JRLRV%3BO5FN6tRAlTJ%3F_v%3D(tN%23V.xm9%25KMD4YP%60T11K%3E(7b%5DQ%22_KF5%5D5%2F%5BGI%3F4Y_hO%3Dn%3CG.3pG%24cz98Zpe4tE0b15%7CQjw%60.%7Bi%24J)%2C4i8ocS!%5BFZKU37B%2BMm1TVGX%5E8Y.NI%22mCN&qp=10000&qq=000001100000&qr=0&gz=0&hh=0&hn=0&qt=0&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&h=600&w=300&fy=0&gp=0&zMoatPS=article-top&zMoatST=Site%20Not%20Defined&zMoatDT=article&f=0&j=https%3A%2F%2Fwww.google.ca&o=3&t=1496926863521&de=338646132070&cu=1496926863521&m=5805&ar=7b317f9-clean&cb=0&ll=2&lm=0&ln=1&r=25.0.0&dl=0&dm=1000&dn=66&gh=1&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1598&qe=1132&qh=1598&qg=1198&lk=undefined&lb=4152&le=1&gm=1&io=1&ch=0&as=0&ag=0&an=0&gf=0&gg=0&ez=1&aj=0&pg=19&pf=19&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&cq=0&im=0&em=0&en=0&bu=5168&cd=122&ah=5168&am=122&rf=0&re=0&wb=1&cl=0&at=0&d=69849197%3A514398557%3A857690837%3A113493498317&bo=8881277&bd=118208237&gw=condenastuk573198052690&ab=1&ac=1&fd=1&kt=strict&it=500&fs=117120&na=873772075&cs=0
Requested by
Host: www.google.ca
URL: https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwj59PWGtJ_UAhWr6YMKHXiqDsIQFghfMAE&url=http%3A%2F%2Fwww.wired.co.uk%2Farticle%2Fwanna-decryptor-ransomware&usg=AFQjCNE363sF26f0cQ2FUAfDDpUy8AQ4gw&sig2=pdL7KEo9n9-XfrpgJEFFtQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.252.144 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-252-144.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
px.moatads.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wired.co.uk/article/wanna-decryptor-ransomware
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 08 Jun 2017 13:01:09 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Thu, 08 Jun 2017 13:01:09 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.wired.co.uk
URL
http://www.wired.co.uk/article/wanna-decryptor-ransomware
Domain
tpc.googlesyndication.com
URL
http://tpc.googlesyndication.com/sodar/9im3l02I.html
Domain
tap2-cdn.rubiconproject.com
URL
http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?pc=11644/36210&geo=eu&co=de
Domain
s0.2mdn.net
URL
https://s0.2mdn.net/3948241/1481725599247/728x90-flexibility/index.html

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Domain/Path Name / Value
.rubiconproject.com/ Name: put_2596
Value: 638737100608227767
.rubiconproject.com/ Name: vis15
Value: 36210^1
.wired.co.uk/ Name: _gat_TRACKER0
Value: 1
.rubiconproject.com/ Name: rsid
Value: DsuWSiL5uMdJFeznfENNwaZbP5mY0DNvptDUA3ThqHQWXoehOHP+SZpge+E4msdf09hVox97znvIHIgvGLlpPLtY/4M8JyTAZsaZtvq+AO1fNYBh4l+EWjJIwylno2WtTOLlOMkADcEbtAjk5G24
.rubiconproject.com/ Name: put_2974
Value: 3448819349784673410
.wired.co.uk/ Name: _gid
Value: GA1.3.1375290225.1496926863
.rubiconproject.com/ Name: ses2
Value: 36210^1
www.wired.co.uk/ Name: kxexpedia_data
Value: cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_cache_8228a075f33e4f44b13aee01f189b7d280a73c60%3A1496928664492%3Bfp%3A2c5c59bb5d00721de253bc7e61e2860c095617b7%3B_fp%3A1512478864493%3Bvisits%3A1%3B_visits%3A1496966400000
.rubiconproject.com/ Name: put_4968
Value: 2854363788835295822
.rubiconproject.com/ Name: csc15
Value:
.wired.co.uk/ Name: _gat_TRACKER1
Value: 1
.rubiconproject.com/ Name: csi15
Value:
.wired.co.uk/ Name: __gads
Value: ID=85b8b463cd338c14:T=1496926862:S=ALNI_Mbcrr-BrhdlJXKe1AV-HqEyLC-APw
.rubiconproject.com/ Name: vis2
Value: 36210^1
.rubiconproject.com/ Name: csc2
Value:
.rubiconproject.com/ Name: ses15
Value:
.rubiconproject.com/ Name: ruid
Value: 566e986e59394a8e94fb2daa5f70fd^1^1496926862^3162227865
tap2-cdn.rubiconproject.com/ Name: pux
Value: 1512%3D65173%261986%3D65173%262146%3D65173%262596%3D65173%262974%3D65173%263778%3D65173%263876%3D65173%264968%3D65173%26
.wired.co.uk/ Name: _ga
Value: GA1.3.661310791.1496926863
.rubiconproject.com/ Name: put_3778
Value: WTlKkAAAAGgcDQ36
.rubiconproject.com/ Name: khaos
Value: J3OFLS75-26-D6SS
.rubiconproject.com/ Name: put_2931
Value: 59394a8fc1ed0a0a765029de
.rubiconproject.com/ Name: csi2
Value:
.rubiconproject.com/ Name: rpb
Value: 17913%3D1%26377322%3D1%2631950%3D1%2613490%3D1%26191940%3D1

5 Console Messages

Source Level URL
Text
console-api log URL: http://www.wired.co.uk/static/js/core.min.js(Line 1)
Message:
%c _ _ _ _ _ | | | | | | (_) (_) | | | | ___ __ _ _ __ ___ | |__ _ _ __ _ _ __ __ _ | |/\| |/ _ \ / _` | '__/ _ \ | '_ \| | '__| | '_ \ / _` | \ /\ / __/ | (_| | | | __/ | | | | | | | | | | | (_| | \/ \/ \___| \__,_|_| \___| |_| |_|_|_| |_|_| |_|\__, | __/ | |___/ %c Are you an awesome software engineer? Join the team in London that builds Wired, Vogue, GQ, Glamour and more. https://code.condenast.co.uk/jobs https://code.condenast.co.uk/home https://www.condenast.co.uk
console-api warning URL: http://www.wired.co.uk/static/js/core.min.js(Line 1)
Message:
OpenX library has no url specified to load. Ads will continue without OpenX
console-api debug URL: http://cdn.adsafeprotected.com/sca.17.2.10.js(Line 20)
Message:
a: 0.2451171875ms
console-api debug URL: http://cdn.adsafeprotected.com/sca.17.2.10.js(Line 20)
Message:
a: 0.02099609375ms
console-api debug URL: http://cdn.adsafeprotected.com/sca.17.2.10.js(Line 20)
Message:
a: 0.011962890625ms

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.atdmt.com
ad.doubleclick.net
ads.rubiconproject.com
b.scorecardresearch.com
beacon-eu2.rubiconproject.com
beacon.krxd.net
c.betrad.com
cdn.adsafeprotected.com
cdn.krxd.net
covers.condenast.co.uk
data04.adlooxtracking.com
dt.adsafeprotected.com
fastlane.rubiconproject.com
googleads4.g.doubleclick.net
j.adlooxtracking.com
l.betrad.com
pagead2.googlesyndication.com
pix.impdesk.com
pixel.adsafeprotected.com
pixel.rubiconproject.com
px.moatads.com
rtd-tm.everesttech.net
s0.2mdn.net
secure-uk.imrworldwide.com
securepubads.g.doubleclick.net
stats.aws.rubiconproject.com
tap2-cdn.rubiconproject.com
tpc.googlesyndication.com
wi-images.condecdn.net
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.wired.co.uk
z.moatads.com
s0.2mdn.net
tap2-cdn.rubiconproject.com
tpc.googlesyndication.com
www.wired.co.uk
107.178.255.114
138.108.96.100
149.202.93.239
151.101.12.175
172.217.22.66
184.73.198.237
216.58.209.66
216.58.209.70
2600:9000:201b:4e00:b:ece0:3340:93a1
2600:9000:2041:4a00:f:4ddd:5d80:93a1
2600:9000:2041:8200:f:4ddd:5d80:93a1
2600:9000:2041:9e00:f:4ddd:5d80:93a1
2600:9000:2041:a400:2:75ac:ea80:93a1
2600:9000:2041:d000:f:4ddd:5d80:93a1
2a00:1450:4001:81d::2001
2a00:1450:4001:81d::2006
2a00:1450:4001:81d::200e
2a00:1450:401b:800::2008
2a00:1450:401b:801::2003
2a00:1450:401b:801::2004
2a00:1450:401b:803::2002
2a03:2880:f01c:202:face:b00c:0:8c
37.187.148.39
46.137.181.13
54.192.48.56
54.235.172.139
54.88.53.255
62.67.193.21
62.67.193.23
62.67.193.61
62.67.193.85
69.172.216.111
69.172.216.55
95.100.189.14
95.100.248.115
95.101.248.119
95.101.252.144
0092592c53cd2e72ed076717c4ada4ab5973eb739a634135f9ac4e9047f55835
012372f12051016cb7845d7870a981995e93f5cc048adba0f445c4e01f2a6b23
03485a7aa4376e0d4c4247e53fbd781331c8620103358fc5f74b4b4b3a60fbb0
03d319469fe8b4f4e92a763631f9fdad271cacc57d98484da54dcf233522a110
0c2f052aa3dd4d01adb7d1342a206348a569d74c32ca5df3f214d5788903c67f
0eddfb21505cbdada300f3db1efd3d67a5ec3ef6381450cab5628239652be7ed
1228207bc671da7b6cce0ca73c10ee4e059055f521c0dcc9bffe6fbca1c16306
142b5afce831d3b6dae5351b495ddc47681f8d9a91eaf4fb4589f7975174bdaa
1544b7868c135e61fb11eca856861fed7db03c229c374cca8ebf0682a97917e4
18ce127fac997d05e6cac7436df99fe45e8a589d26d1c891aa127e8b2af572a1
1a4917e8c8bc591b68a7465ba8e89cc7235dccf0712adf1577fe6787257375e6
1aac7ab7b21ee9a7169669311e9858868ad5c0e98214bfb1b21f5e45ddb1f322
1ee34cb3f075b4b380e8f86be5edb78c261d6c35517dc17a2473ea86e79c7983
2048910d091b4038586f4c3ac4ae4f3d0a07c694ae2f250b0cef9d0f6d77b882
21a8144e29cf2f60d7361fa7bd962e302b324573faecadeb4992e450954b532d
259ab0d97c563730da806e47ade02b4503a17b39f8e572aa1afe5ed93ce44896
270ac0c10812122c6dc17a0c4a8d6e0665a4d87e47e382f02219707125263aff
285c72953eb85aeef5a80f8f900d0066e0a714565dd63c1adee46c67e1138159
308f8bdcf38cb0444e21460cbeab65cb8870a50da2115f7813943ccbe203b3a3
32e156c1c8a7a9a992bcab36ad7e788f453948e89a51c1c373f7ac94d9894148
334d4f3169c74d17560212a6272a7605e6ebe9a333bc828ff919b897f0e8bf6e
388bcb07ac4c0c6a95dd7b8bc2d1daf52f56c1d22dbec296f24c588b1f2d5d64
3e84d0bb4b82f7e481943eefd64510b6e426d739cb87c430091f5ba82df0096d
3f01c1d48553b4b34257ae00e19fb344479f20aedcc33a5e67697cb1346531db
4264ac5aef251823acda796ee6213807514ad4fd8642200631635b6e310b9a73
4b1bd7c0e4d4f895792e782dc10e2bf8c7e54c39ad0e87d5b861f937c080b05c
4b77c85f0c01d60126d5151609df823cce47ef123f1dcbab664b7fd255dc1374
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
51144c1675de608488b78ff0316e911d9f030842c323cdaaa4f12e0f4614ba48
54184ed178682c22a6a30a1f76127697d3768ce2b488fe77948a1a3e68c1b70a
557007834448c888efaa01c2c1d25155130fea075308b3bdb1ea87662b82a2ae
5e507ddda723c043bcedc78b7a9958eb3e02ba9e1fff62c69ae60aa6f4110393
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
65122f8522286c501451450d5fb0c04f8ec14549d2fa7d89c092041e2f140dc1
6a6eaa4002fe9ca7fd03b3e99e4ad1cd25c6a71d8d0a781089330b1a94fe6e52
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
70b93ab778d4a9e687810c9dc22c1572c70a665566f47f3c8ed3ba4550aee272
70ccb2c9bbcaff90719cf917e90b949cf9b2cb71fb6d27e3cc0f6f69ac813725
72439b41fcc41f01b52310c6bb38eb1a4ae190cbb079661f453a8661f6af174c
7587c0ab49ef39a7fcdb15650e1c67c298e71fe57ded6e9ec5b072c0a2780b29
779a80c8b614e7528f9e838b20bf3d127f78a4093959390dcb7f8d26fdac81d9
80494f8c23ca7839948bfe1c5d5e85938d8377cc5ac69fb99909ef7dfa9c6180
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c2789be580b7cd332e266ef9ea3fd3b0e3e51dc1cfd0f3474e8a54b6eb08b8e
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
8f7b22328ad3116b976f52e10c243761ada4d562e1e10762340517b95f94b737
913529a1ab355be3064eee81a60e3d79fbbd2702df8a1da88437ee7fb80115e3
935417d579026e3876a4536bbbdbb6904f9d38b2e239681434e738daf317e14a
9418b1be59b2c83ddde4ad2a65a4f04d87d6074c3cb7af5bda9ca1bab6aedb20
96d3bf038966f99afc2c91b78a83c887caf0456db1e58ed2c7be2504dde9e810
9760b320381e06b5405766433311259da92acb92e378ba7abfd5a9c7b655e8ae
99db9d11463162fc6fdf9f9507f700577392f68fa60325ded01cf9221c341e32
a3c92e8d35e4e636238e577da8cd44aaf8dd699b719e4125ba0029330edf6907
a68bb24c998d629c3b69d7548e978280e032008296bfaea6db6bc743e59652ce
aace23a5db8d32842266843af7466468690e08e96e376c6bbfc452d2178e597e
ab694d75a071ce08545153773898a73588d11fe6af6d1d88f7b72f3d3da07a3a
ac4f9618be0b43e3a85ccb1b5ae9b9c5efbe4d1ac30bcd5db7b624a767024481
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ae44cce4c55f272abdfd4786bb1b5e953198cd6f9d1d309e354d7b3eb4758f55
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2347e897675c8c16b970dc27135b1ec5aa29c0a28f81fd324855923cd55c461
bb854b0a9cccbc78e34e4450f357de5e5764c9ddae6c1cecd285fb4bc9560c85
c2b9c24d3b675a69e331f4cc79f3fbb7a4c6181b3717276f3bf690c3ab36ad8a
c364eb4d3cac1555e3150ac08b756d9de5ac16182fa2dcff853baaabb9153d87
c5050ac31a6a934d14104feb6bcbba3711b384574deb4af319c8c7b009b88588
c5b6a6c4915c90208d9b974b47815e9ec73ded1494a1793ed28eae2ff0e23b9a
c937f9cdc6de247e1b571b2210a1c0a853cc324aff18b8598649daaa4bdec25a
c9c7af72f5cedeabbf7a0bd1f8e1f4365c36809a9d7b97e969f6665a46ad1466
ca3863872db00555edc5587294ecc9ba9ceea809c4d79a3546f8ee3f0476aa6d
cc21c5f688ca201fdb54b0329b33a26e387dd98b1eb48f51a1df89e3bec110e4
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d01c52ca43aaa120298d41522f3682e796658f0efb01d92ff0bde67cee3171b0
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912
d1503adac4592afadb3512556a9493d6d3c6b4c81ac477e8dfa1addfd0e39dc8
d5fcce798c65ea9bf707effef1a45ad9b11649b6b29314fd0e4d2cc32041c8ae
d610d2df82f2c9ab6c1eb029aa98df866e30ee534bd8a908b811e8ad25ab7ede
da0f33b8ac9b94b5f21dff3b54ce2ecdb781d694510569cac41dfb26adbb8956
db5c07a4d05acff4c2e67f7ac28a370de49f5998bbd758841cd2ec60f7c84066
de3a7ca2f8ae592aae2652335b755b0d0b65df663dda8776387cae7339b76d64
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5cfe524a65aa27412b013f6d7b84a766891b66f76f56ab3c67196ca58b565f7
e5e5791b5b8e76885e9601f3ca4752d23db5d3559c8aa078d9d69dde6b4f7079
e5f458a4ef5e2c5a88aa6e95166cfb6c43018a7f7abd162e44962408f853e0ba
e9821a47343199c5cbd2aa1bbcfb63156505218ecab46b32a19b7215b37a2df8
eb938e52c8333f8339aefd26a55019ad44c03c6d214b8fcf7ef5f8893e103cfd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f061903e91136a670ee391e65b5b85f0dfa50939e3c7febb662e30502a5540a2
f3f439511ea7c3536083910d282e2d0903329127b493ea73cf42759280b30cf0
fb7f18ace8b2fc439d948d51037f44c1612da5252c177549873c704bcc5236e8
fb80487775677e61280ccbce05f36a3d6ce72cb2df59c58d07c365472d3793d1