www.darkreading.com Open in urlscan Pro
2606:4700::6811:7863 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Submission: On February 25 via manual (February 25th 2019, 9:25:19 pm UTC) from US

Summary HTTP 248 Redirects Links 74 Behaviour Indicators

Summary

This website contacted 62 IPs in 5 countries across 42 domains to perform 248 HTTP transactions. The main IP is 2606:4700::6811:7863, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.darkreading.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on January 18th 2019. Valid for: 6 months.

This is the only time www.darkreading.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 8	2606:4700::68... 2606:4700::6811:7863	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:81a::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
14	2606:4700:30:... 2606:4700:30::681f:5172	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
6	2606:4700:30:... 2606:4700:30::6818:7975	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2606:4700:20:... 2606:4700:20::6818:452	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.139.239.5 151.139.239.5	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE - Google LLC)
41	2606:4700:30:... 2606:4700:30::681b:8a16	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
9	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	2600:9000:200... 2600:9000:200d:fc00:e:5a70:ca47:86e1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	2606:2800:234... 2606:2800:234:b6ab:6556:9a85:ba61:ee81	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
12	54.230.203.131 54.230.203.131	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.241.198.89 34.241.198.89	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a00:1450:400... 2a00:1450:4001:814::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:825::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
11	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
2	172.82.228.18 172.82.228.18	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
11	216.58.205.226 216.58.205.226	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	66.117.29.6 66.117.29.6	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1	23.111.11.217 23.111.11.217	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1 1	2606:4700::68... 2606:4700::6813:f408	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	54.146.200.135 54.146.200.135	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 4	23.45.99.242 23.45.99.242	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	46.105.202.39 46.105.202.39	16276 (OVH) (OVH)
7	2a00:1450:400... 2a00:1450:4001:81b::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81a::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
2	204.79.197.200 204.79.197.200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	52.49.47.75 52.49.47.75	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:820::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
5	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	2600:9000:200... 2600:9000:200d:f800:14:85db:2b40:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a03:2880:f02... 2a03:2880:f029:16:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	3.122.87.50 3.122.87.50	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:825::2006	15169 (GOOGLE) (GOOGLE - Google LLC)
1	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE - Google LLC)
20	54.230.202.118 54.230.202.118	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	54.230.202.82 54.230.202.82	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	2.18.232.7 2.18.232.7	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2620:103::192... 2620:103::192:155:48:119	19994 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
1	184.31.90.134 184.31.90.134	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.120.159 151.101.120.159	54113 (FASTLY) (FASTLY - Fastly)
1 2	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER - Twitter Inc.)
1 2	142.0.160.13 142.0.160.13	7160 (NETDYNAMICS) (NETDYNAMICS - Oracle Corporation)
1 2	209.167.231.17 209.167.231.17	7160 (NETDYNAMICS) (NETDYNAMICS - Oracle Corporation)
6	2606:2800:134... 2606:2800:134:1a0d:1429:742:782:b6	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
4	54.209.11.67 54.209.11.67	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2a02:26f0:6c0... 2a02:26f0:6c00:292::2c92	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:816::2014	15169 (GOOGLE) (GOOGLE - Google LLC)
5	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	54.230.202.81 54.230.202.81	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2.18.233.40 2.18.233.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2	46.51.186.75 46.51.186.75	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	54.174.196.40 54.174.196.40	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
248	62

8 2606:4700::6811:7863 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.darkreading.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700:30::681f:5172 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

twimgs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:30::6818:7975 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

i.ubm-us.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsimg.ubm-us.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::6818:452 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

epromos.ubmcanon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.239.5 (Dallas, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

static.adsnative.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s28-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2606:4700:30::681b:8a16 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

img.deusm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:200d:fc00:e:5a70:ca47:86e1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cdn.flipboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:b6ab:6556:9a85:ba61:ee81 (United States) 1 redirects

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 54.230.203.131 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-203-131.fra50.r.cloudfront.net

cf-images.us-east-1.prod.boltdns.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.241.198.89 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-241-198-89.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2004 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:821::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.82.228.18 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.d3.sc.omtrdc.net

ubmtech.d3.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (Lehi, United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 216.58.205.226 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.6 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)

ubm.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

api-cache.adsnative.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:f408 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

rudy.adsnative.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.146.200.135 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-146-200-135.compute-1.amazonaws.com

t.cwkuki.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.45.99.242 (Amsterdam, Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-99-242.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.105.202.39 (France)

ASN16276 (OVH, FR)

u.heatmap.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:81b::2001 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 204.79.197.200 (Redmond, United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: a-0001.a-msedge.net

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.47.75 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-47-75.eu-west-1.compute.amazonaws.com

ubm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80b::2001 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.134 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s46-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:200d:f800:14:85db:2b40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

fpn.flipboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f029:16:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

staticxx.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.122.87.50 (Fairfield, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-122-87-50.eu-central-1.compute.amazonaws.com

ads.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2006 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.66 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s17-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 54.230.202.118 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-202-118.fra50.r.cloudfront.net

cache-ssl.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.202.82 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-202-82.fra50.r.cloudfront.net

img.lightreading.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.18.232.7 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-7.deploy.static.akamaitechnologies.com

a.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
t.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:103::192:155:48:119 (United States)

ASN19994 (RACKSPACE - Rackspace Hosting, US)

ng.techweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.31.90.134 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-90-134.deploy.static.akamaitechnologies.com

img.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.120.159 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.200 (San Francisco, United States) 1 redirects

ASN13414 (TWITTER - Twitter Inc., US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.0.160.13 (Redwood City, United States) 1 redirects

ASN7160 (NETDYNAMICS - Oracle Corporation, US)

s657486201.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.167.231.17 (United States) 1 redirects

ASN7160 (NETDYNAMICS - Oracle Corporation, US)
PTR: e017.en25.com

s2150.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:134:1a0d:1429:742:782:b6 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

ton.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.209.11.67 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-209-11-67.compute-1.amazonaws.com

track.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:292::2c92 (European Union)

ASN20940 (AKAMAI-ASN1, US)

cmp.teads.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2014 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

amp-error-reporting.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:819::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.230.202.81 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-202-81.fra50.r.cloudfront.net

cache-ssl.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.40 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-40.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.51.186.75 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-46-51-186-75.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.174.196.40 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-174-196-40.compute-1.amazonaws.com

track.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	deusm.com img.deusm.com	358 KB
33	celtra.com ads.celtra.com cache-ssl.celtra.com track.celtra.com	449 KB
16	doubleclick.net 1 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net ad.doubleclick.net googleads4.g.doubleclick.net	114 KB
14	twimgs.com twimgs.com	262 KB
12	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	600 KB
12	boltdns.net cf-images.us-east-1.prod.boltdns.net	40 KB
11	googletagservices.com www.googletagservices.com	134 KB
11	twitter.com 1 redirects platform.twitter.com syndication.twitter.com	118 KB
9	twimg.com cdn.syndication.twimg.com pbs.twimg.com ton.twimg.com	85 KB
8	darkreading.com 1 redirects www.darkreading.com	48 KB
6	teads.tv a.teads.tv t.teads.tv sync.teads.tv	185 KB
6	ubm-us.net i.ubm-us.net dsimg.ubm-us.net	116 KB
5	ampproject.org cdn.ampproject.org	135 KB
5	facebook.com www.facebook.com staticxx.facebook.com	342 B
4	adroll.com s.adroll.com d.adroll.com	79 KB
4	eloqua.com 2 redirects s657486201.t.eloqua.com s2150.t.eloqua.com	2 KB
4	facebook.net connect.facebook.net	116 KB
4	scorecardresearch.com 1 redirects sb.scorecardresearch.com	2 KB
4	flipboard.com 1 redirects cdn.flipboard.com fpn.flipboard.com	5 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	103 KB
3	omtrdc.net ubmtech.d3.sc.omtrdc.net ubm.tt.omtrdc.net	1 KB
3	demdex.net dpm.demdex.net ubm.demdex.net	2 KB
3	adsnative.com 1 redirects static.adsnative.com api-cache.adsnative.com rudy.adsnative.com	19 KB
3	ubmcanon.com epromos.ubmcanon.com	67 KB
2	appspot.com amp-error-reporting.appspot.com	217 B
2	bing.com bat.bing.com	7 KB
2	heatmap.it u.heatmap.it	10 KB
2	google.de adservice.google.de www.google.de	287 B
2	google-analytics.com ssl.google-analytics.com	17 KB
2	google.com www.google.com	671 B
2	linkedin.com 1 redirects platform.linkedin.com	55 KB
2	googleapis.com fonts.googleapis.com	917 B
1	ytimg.com s.ytimg.com	8 KB
1	youtube.com www.youtube.com	1 KB
1	consensu.org cmp.teads.mgr.consensu.org
1	en25.com img.en25.com	3 KB
1	techweb.com ng.techweb.com
1	lightreading.com img.lightreading.com	354 B
1	2mdn.net s0.2mdn.net	519 KB
1	cwkuki.com t.cwkuki.com	196 B
1	everesttech.net 1 redirects cm.everesttech.net	527 B
1	googleadservices.com www.googleadservices.com	9 KB
248	42

	Domain	Requested by
41	img.deusm.com	www.darkreading.com securepubads.g.doubleclick.net www.googletagservices.com
22	cache-ssl.celtra.com	ads.celtra.com www.darkreading.com
14	twimgs.com	www.darkreading.com
12	cf-images.us-east-1.prod.boltdns.net	www.darkreading.com
11	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.darkreading.com
11	www.googletagservices.com	www.darkreading.com securepubads.g.doubleclick.net www.googletagservices.com ad.doubleclick.net
10	track.celtra.com	www.darkreading.com
9	platform.twitter.com	www.darkreading.com platform.twitter.com
8	www.darkreading.com	1 redirects www.darkreading.com
7	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.darkreading.com ad.doubleclick.net tpc.googlesyndication.com
6	pbs.twimg.com	www.darkreading.com
5	pagead2.googlesyndication.com	www.darkreading.com
5	cdn.ampproject.org	securepubads.g.doubleclick.net
4	www.facebook.com	www.darkreading.com connect.facebook.net
4	connect.facebook.net	www.darkreading.com connect.facebook.net
4	sb.scorecardresearch.com	1 redirects www.darkreading.com
3	a.teads.tv	securepubads.g.doubleclick.net a.teads.tv
3	ad.doubleclick.net	1 redirects www.darkreading.com www.googletagservices.com
3	dsimg.ubm-us.net	www.darkreading.com
3	epromos.ubmcanon.com	www.darkreading.com
3	i.ubm-us.net	www.darkreading.com
2	d.adroll.com	s.adroll.com
2	s.adroll.com	www.darkreading.com s.adroll.com
2	amp-error-reporting.appspot.com	cdn.ampproject.org
2	t.teads.tv	www.darkreading.com
2	ton.twimg.com	platform.twitter.com
2	s2150.t.eloqua.com	1 redirects www.darkreading.com
2	s657486201.t.eloqua.com	1 redirects www.darkreading.com
2	syndication.twitter.com	1 redirects www.darkreading.com
2	fpn.flipboard.com	1 redirects www.darkreading.com
2	fonts.gstatic.com	www.darkreading.com
2	bat.bing.com	www.darkreading.com
2	u.heatmap.it	www.darkreading.com u.heatmap.it
2	ubmtech.d3.sc.omtrdc.net	epromos.ubmcanon.com www.darkreading.com
2	ssl.google-analytics.com	www.darkreading.com
2	www.google.com	dsimg.ubm-us.net www.darkreading.com
2	dpm.demdex.net	epromos.ubmcanon.com www.darkreading.com
2	platform.linkedin.com	1 redirects www.darkreading.com
2	cdn.flipboard.com	www.darkreading.com
2	fonts.googleapis.com	www.darkreading.com
1	s.ytimg.com	www.youtube.com
1	www.youtube.com	www.darkreading.com
1	sync.teads.tv	a.teads.tv
1	cmp.teads.mgr.consensu.org	a.teads.tv
1	cdn.syndication.twimg.com	platform.twitter.com
1	img.en25.com	twimgs.com
1	ng.techweb.com	twimgs.com
1	img.lightreading.com	www.darkreading.com
1	googleads4.g.doubleclick.net	www.darkreading.com
1	s0.2mdn.net	www.darkreading.com
1	ads.celtra.com	www.darkreading.com
1	staticxx.facebook.com	connect.facebook.net
1	www.google.de	www.darkreading.com
1	www.gstatic.com	www.google.com
1	ubm.demdex.net	epromos.ubmcanon.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	t.cwkuki.com	www.darkreading.com
1	rudy.adsnative.com	1 redirects
1	api-cache.adsnative.com	static.adsnative.com
1	ubm.tt.omtrdc.net	epromos.ubmcanon.com
1	adservice.google.de	www.googletagservices.com
1	cm.everesttech.net	1 redirects
1	www.googleadservices.com	www.darkreading.com
1	static.adsnative.com	www.darkreading.com
248	64

This site contains links to these domains. Also see Links.

Domain
www.informationweek.com
www.networkcomputing.com
ng.techweb.com
createyournextcustomer.com
reports.informationweek.com
www.facebook.com
twitter.com
www.linkedin.com
www.interop.com
flipboard.com
share.flipboard.com
ago.vermont.gov
www.bleepingcomputer.com
webinar.darkreading.com
reg.interop.com
adclick.g.doubleclick.net
www.enterpriseconnect.com
web.nvd.nist.gov
www.wrightsreprints.com
plus.google.com
www.ubmtechweb.com
www.blackhat.com
contentmarketinginstitute.com
www.contentmarketingworld.com
www.gdconf.com
www.gamasutra.com
www.thinkhdi.com
www.icmi.com
www.nojitter.com
www.smworld.com
www.xrdconf.com
tech.ubm.com
wrightsmedia.com
legal.us.ubm.com
reg.ubmamevents.com

Subject Issuer	Validity	Valid
ssl764998.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-01-18` - `2019-07-27`	6 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
sni136658.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-01-18` - `2019-07-27`	6 months	crt.sh
sni136530.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-02-22` - `2019-08-31`	6 months	crt.sh
ssl378091.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-12-28` - `2019-07-06`	6 months	crt.sh
*.adsnative.com DigiCert SHA2 Secure Server CA	`2018-04-20` - `2019-04-25`	a year	crt.sh
www.googleadservices.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
sni137786.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-11-26` - `2019-06-04`	6 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2018-11-19` - `2019-11-27`	a year	crt.sh
*.flipboard.com DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2019-11-06`	2 years	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2017-10-25` - `2019-10-30`	2 years	crt.sh
*.prod.boltdns.net Amazon	`2019-01-02` - `2020-02-02`	a year	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
www.google.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
*.d3.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2016-05-04` - `2019-05-23`	3 years	crt.sh
*.google.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.cwkuki.com Amazon	`2019-02-11` - `2020-03-11`	a year	crt.sh
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA	`2018-11-28` - `2019-12-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-01-21` - `2019-04-21`	3 months	crt.sh
*.heatmap.it COMODO RSA Domain Validation Secure Server CA	`2016-06-05` - `2019-06-27`	3 years	crt.sh
tpc.googlesyndication.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 5	`2017-07-20` - `2019-07-10`	2 years	crt.sh
www.google.de Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
misc-sni.google.com Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
*.doubleclick.net Google Internet Authority G3	`2019-01-29` - `2019-04-23`	3 months	crt.sh
*.celtra.com Go Daddy Secure Certificate Authority - G2	`2018-05-15` - `2020-06-15`	2 years	crt.sh
img.lightreading.com Amazon	`2019-02-21` - `2020-03-21`	a year	crt.sh
teads.tv Let's Encrypt Authority X3	`2019-01-02` - `2019-04-02`	3 months	crt.sh
ng.techweb.com Let's Encrypt Authority X3	`2019-01-17` - `2019-04-17`	3 months	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2018-04-25` - `2019-07-25`	a year	crt.sh
cdn.syndication.twimg.com DigiCert SHA2 High Assurance Server CA	`2018-08-16` - `2019-08-21`	a year	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-01-24` - `2020-01-24`	a year	crt.sh
*.t.eloqua.com DigiCert SHA2 Secure Server CA	`2019-01-14` - `2020-03-14`	a year	crt.sh
teads.mgr.consensu.org Let's Encrypt Authority X3	`2019-02-22` - `2019-05-23`	3 months	crt.sh
*.appspot.com Google Internet Authority G3	`2019-02-13` - `2019-05-08`	3 months	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2018-12-19` - `2020-03-19`	a year	crt.sh

This page contains 22 frames:

Primary Page: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Frame ID: 5A8552CB74752E55BEAEA247A1EE3BEF
Requests: 158 HTTP requests in this frame

Frame: https://ubm.demdex.net/dest5.html?d_nsid=0
Frame ID: BED7019E5A780AD674C4F5797DAB7E3B
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: 4892B4922A6EA0FF00ED36E84070B037
Requests: 4 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: AAF4CBDEB8BFADBD9315641E41A79950
Requests: 5 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js
Frame ID: 280ECB08156AE3280D9877E96CDBC018
Requests: 7 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter/r/vy-MhgbfL4v.js?version=44
Frame ID: FAFBE6DB15BD544BBBD5FF02FF089EFA
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: E0E0919660AB6F269EC40337A28A7B3B
Requests: 3 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: 74816A8E20EBAF6E17BF22847DEEF508
Requests: 5 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: C646D338EEC35E9F64AB88E43535FE93
Requests: 12 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js
Frame ID: E52697759591E399746689B25073E997
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/6uQTKQJz.html
Frame ID: BA2FF6EBA82081FF956E367A5DA74CE3
Requests: 1 HTTP requests in this frame

Frame: https://a.teads.tv/page/11512/tag
Frame ID: D84DD07D50582C9C2B3A10C5B678E01D
Requests: 4 HTTP requests in this frame

Frame: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Frame ID: E8AEDCCA5577AA15EC25377B5CD0B62A
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.704fca4914c9b90d7a9d41abcaa19933.html?origin=https%3A%2F%2Fwww.darkreading.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Frame ID: F0C43AF98F52564E4C35DE826652ACDB
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/ping?client_id=640989409269461&domain=www.darkreading.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2Fvy-MhgbfL4v.js%3Fversion%3D44%23cb%3Df3b0247d279c02%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff129a53e5d44c6c%26relation%3Dparent&response_type=token%2Csigned_request&sdk=joey
Frame ID: 8550CA563CE11C4DF0E1EA52EC9B9E97
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2Fvy-MhgbfL4v.js%3Fversion%3D44%23cb%3Df18fa74e9aa58c%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff129a53e5d44c6c%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
Frame ID: C7F3F5B80AC971B108EB0BF20A4DEA0E
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.704fca4914c9b90d7a9d41abcaa19933.en.html
Frame ID: C94B28A4EBDCBC6E44CC718272443198
Requests: 1 HTTP requests in this frame

Frame: https://pbs.twimg.com/card_img/1098681041198436354/tOiGiTD6?format=jpg&name=144x144_2
Frame ID: 44A62FA2DDEF39F7FED04EB09967F99B
Requests: 10 HTTP requests in this frame

Frame: https://cmp.teads.mgr.consensu.org/index.html
Frame ID: A02BA9A0E49C8905879D97D3D33E85E7
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Lato:400&text=BCDEGILORSTUVW
Frame ID: 9CBB281C089A9E4B2C1432FB5221D6DC
Requests: 26 HTTP requests in this frame

Frame: https://sync.teads.tv/iframe?pid=21882&userId=d031b722-12a3-44f3-ae4b-ab06dc4de21b&gdprIab={%22status%22:22,%22consent%22:%22%22,%22reason%22:220}&1551129903632
Frame ID: FAEDE31D2A889593C34C0A96CBDB64C0
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 7D53DBFE62C94A335DBFAA024EBE47A7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

JavaScript Infovis Toolkit (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

script /jit.*\.js/i

jQuery Mobile (Mobile Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /jquery\.mobile(?:-([\d.]+rc\d))?.*\.js(?:\?ver=([\d.]+))?/i

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

env /^adroll_/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Eloqua (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

env /^elq(?:SiteID|Load|CurESite)$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

env /^__google_ad_/i
env /^Goog_AdSense_/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^googletag$/i

SiteCatalyst (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^s_(?:account|objectID|code|INST)$/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
env /^_?COMSCORE$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i
script /jquery\.mobile(?:-([\d.]+rc\d))?.*\.js(?:\?ver=([\d.]+))?/i

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

env /^Recaptcha$/i

Page Statistics

248
Requests

97 %
HTTPS

52 %
IPv6

42
Domains

64
Subdomains

62
IPs

5
Countries

3671 kB
Transfer

8243 kB
Size

32
Cookies

74 Outgoing links

These are links going to different origins than the main page.

URL: http://www.informationweek.com/

Search URL Search Domain Scan URL

URL: https://www.networkcomputing.com/
Title: Network Computing

Search URL Search Domain Scan URL

URL: https://ng.techweb.com/authds/gateway?gateway=true&return=https%3A%2F%2Fwww%2Edarkreading%2Ecom%2Fthreat%2Dintelligence%2Fturbotax%2Dhit%2Dwith%2Dcyberattack%2Dtax%2Dreturns%2Dcompromised%2Fd%2Fd%2Did%2F1333954%3FngAction%3Dregister
Title: Register

Search URL Search Domain Scan URL

URL: http://createyournextcustomer.com/contact-me/
Title: Advertise

Search URL Search Domain Scan URL

URL: http://reports.informationweek.com/search?search=security
Title: Reports

Search URL Search Domain Scan URL

URL: http://www.informationweek.com/whitepaper/Security
Title: White Papers

Search URL Search Domain Scan URL

URL: https://www.facebook.com/darkreadingcom
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/DarkReading
Title: Twitter

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/groups?home=&gid=3193466&trk=anet_ug_hm
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.interop.com/

Search URL Search Domain Scan URL

URL: https://flipboard.com/@DarkReading?utm_campaign=tools&utm_medium=follow&action=follow

Search URL Search Domain Scan URL

URL: http://www.informationweek.com/whitepaper
Title: Tech Library

Search URL Search Domain Scan URL

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&t=1551129902314&utm_campaign=tools&utm_medium=article-share&utm_source=www.darkreading.com

Search URL Search Domain Scan URL

URL: https://ago.vermont.gov/wp-content/uploads/2019/02/2019-02-22-Intuit-Notice-of-Data-Breach-to-Consumers.pdf
Title: letter

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/tax-returns-exposed-in-turbotax-credential-stuffing-attacks/
Title: here

Search URL Search Domain Scan URL

URL: https://www.interop.com/darkreading/?_mc=hsad_x_drr_le_tsnr_intplv_x_x-drvplug
Title: Interop agenda

Search URL Search Domain Scan URL

URL: https://webinar.darkreading.com/5032?keycode=sbx&cid=smartbox_techweb_webcast_8.500000875
Title: How to Use AI & Machine Learning to Improve Security

Search URL Search Domain Scan URL

URL: https://webinar.darkreading.com/4860?keycode=sbx&cid=smartbox_techweb_webcast_8.500000873
Title: Overcoming Cyberthreats to Critical Infrastructure with Integrated IT/OT Cybersecurity

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/security-management-and-analytics/security-monitoring/2018-report-the-evolution-of-the-secure-software-lifecycle/401583?cid=smartbox_techweb_whitepaper_14.500003410
Title: [Report] The Evolution of the Secure Software Lifecycle

Search URL Search Domain Scan URL

URL: http://www.informationweek.com/whitepaper/endpoint-security/smb-security/esg-report-endpoint-security-must-include-rapid-query-and-remediation-capabilities/399663?cid=smartbox_techweb_whitepaper_14.500003308
Title: [ESG Report] Endpoint Security Must Include Rapid Query & Remediation Capabilities

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/network-and-perimeter-security/online-malware-and-threats-a-profile-of-today's-security-posture/402043?cid=smartbox_techweb_analytics_7.300005753
Title: Online Malware & Threats: A Profile of Today's Security Posture

Search URL Search Domain Scan URL

URL: http://reg.interop.com/stateofcloud_2018?kcode=ncsite_sbx&cid=smartbox_techweb_analytics_7.300005743
Title: 2018 State of the Cloud Report

Search URL Search Domain Scan URL

URL: http://reports.informationweek.com/search?search=security/
Title: More Reports

Search URL Search Domain Scan URL

URL: https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvUQSoOaUjguZU7BMPscW6mBvCKYcGAI4NlATcRQnTN2aFLa4ZfKNvQGDHR0sxi3h4HjJ0-oxPTLw8Wn2c9SUws1h-0gBEVzM29Qaz6fWehCw0cvsG-YP8JEPGT1h47gAG9X2aJ4zFmw6QbTB6HPHi48JkDFwe4k2qID6TjSEjv4CO7t3cP6r9yhIgl1paSYVTp-uciaZaJVmm5jCimEM_0ozaPwliu-U7r6mdyN4BzAnzMMIo2xjSJGFyJXlT3w-aJ88fChurYbFNCbmwe62w%2526sai%253DAMfl-YQuefROnefbubxqURzyFQeQ9dk1vhFCikFjT-2dbgpIhfyYdrwBkpmrZHAPIdxsLbxmtWsnAvXr8v8-HRnOHPCNfMO-3vZI3TrH-nyf%2526sig%253DCg0ArKJSzOmEu6lChFaZEAE%2526urlfix%253D1%2526adurl%253Dhttps://www.informationweek.com/whitepaper/security-monitoring/security-management-and-analytics/gartner-report-align-net-ops-and-sec-ops/403073%3Fcid%3Dmp_dr_natvad%26_mc%3Dmp_dr_natvad

Search URL Search Domain Scan URL

URL: https://www.interop.com/?_mc=sbx_x_intplv_edt_aud_allan_x_x-IWKSB&cid=smartbox_techweb_session_16.500209
Title: Drive Your Business and Career Forward at Interop19

Search URL Search Domain Scan URL

URL: https://www.interop.com/?_mc=sbx_x_intplv_edt_aud_allan_x_x-IWKSB&cid=smartbox_techweb_session_16.500208
Title: Interop 2019 - The Unbiased IT Conference

Search URL Search Domain Scan URL

URL: https://www.enterpriseconnect.com/orlando/conference/enterprise-communications-collaboration?_mc=iwksmbx&cid=smartbox_techweb_session_16.500207
Title: Communications & Collaboration 2022 at EC19 Orlando March 18-21

Search URL Search Domain Scan URL

URL: https://webinar.darkreading.com/5223?keycode=sbx&cid=smartbox_techweb_webcast_8.500000874
Title: Tools & Techniques to Disrupt Lateral Movement

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/security-monitoring/[sans]-the-need-for-speed-integrated-threat-response/405543?cid=smartbox_techweb_whitepaper_14.500003484
Title: [SANS] The Need for Speed: Integrated Threat Response

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/security-management-and-analytics/2018-cyberthreat-defense-report/402213?cid=smartbox_techweb_whitepaper_14.500003421
Title: 2018 Cyberthreat Defense Report

Search URL Search Domain Scan URL

URL: http://www.informationweek.com/whitepaper/cybersecurity/security-monitoring/left-of-breach/396983?cid=smartbox_techweb_whitepaper_14.500003240
Title: Want to Stay In Front of Breaches? Train Like The Marines.

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/security-monitoring/how-enterprises-are-attacking-the-cybersecurity-problem/402433?cid=mp_rptbx&_mc=mp_rptbx

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/security-monitoring/risk-management/how-enterprises-are-using-it-threat-intelligence/402513?cid=mp_rptbx&_mc=mp_rptbx
Title: How Enterprises Are Using IT Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/security-monitoring/risk-management/how-enterprises-are-using-it-threat-intelligence/402513?cid=mp_rptbx&_mc=mp_rptbx#msgs
Title: 0 comments

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/network-and-perimeter-security/online-malware-and-threats-a-profile-of-today's-security-posture/402043?cid=mp_rptbx&_mc=mp_rptbx
Title: Online Malware and Threats: A Profile of Today's Security Posture

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/risk-management-security/security-monitoring/the-risk-management-struggle/400923?cid=mp_rptbx&_mc=mp_rptbx
Title: The Risk Management Struggle

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/risk-management-security/security-monitoring/the-risk-management-struggle/400923?cid=mp_rptbx&_mc=mp_rptbx#msgs
Title: 0 comments

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20033
Title: CVE-2018-20033

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9151
Title: CVE-2019-9151

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9152
Title: CVE-2019-9152

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9146
Title: CVE-2019-9146

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1683
Title: CVE-2019-1683

Search URL Search Domain Scan URL

URL: http://www.wrightsreprints.com/reprints/?magid=2202
Title: Reprints

Search URL Search Domain Scan URL

URL: https://plus.google.com/+darkreading
Title: Google+

Search URL Search Domain Scan URL

URL: http://www.ubmtechweb.com/

Search URL Search Domain Scan URL

URL: http://www.blackhat.com/
Title: Black Hat

Search URL Search Domain Scan URL

URL: http://contentmarketinginstitute.com/
Title: Content Marketing Institute

Search URL Search Domain Scan URL

URL: http://www.contentmarketingworld.com/
Title: Content Marketing World

Search URL Search Domain Scan URL

URL: http://www.enterpriseconnect.com/
Title: Enterprise Connect

Search URL Search Domain Scan URL

URL: http://www.gdconf.com/
Title: GDC

Search URL Search Domain Scan URL

URL: http://www.gamasutra.com/
Title: Gamasutra

Search URL Search Domain Scan URL

URL: http://www.thinkhdi.com/
Title: HDI

Search URL Search Domain Scan URL

URL: http://www.icmi.com/
Title: ICMI

Search URL Search Domain Scan URL

URL: http://www.interop.com/
Title: Interop

Search URL Search Domain Scan URL

URL: http://www.networkcomputing.com/
Title: Network Computing

Search URL Search Domain Scan URL

URL: http://www.nojitter.com/
Title: No Jitter

Search URL Search Domain Scan URL

URL: http://www.smworld.com/
Title: Service Management World

Search URL Search Domain Scan URL

URL: http://www.xrdconf.com/
Title: XRDC

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/content-marketing
Title: Content Marketing

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/enterprise-it
Title: Enterprise IT

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/enterprise-communications
Title: Enterprise Communications

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/game-and-vr-development
Title: Game and VR Development

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/information-security
Title: Information Security

Search URL Search Domain Scan URL

URL: http://tech.ubm.com/community-brands/technical-service-and-support/
Title: IT Services & Support / Contact Center

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/contact-us
Title: Advertising Contacts

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/event-calendar
Title: Event Calendar

Search URL Search Domain Scan URL

URL: https://tech.ubm.com/
Title: Tech Marketing Solutions

Search URL Search Domain Scan URL

URL: http://tech.ubm.com/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: http://wrightsmedia.com/sites/ubm/index.cfm
Title: Licensing

Search URL Search Domain Scan URL

URL: http://legal.us.ubm.com/terms-of-service/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: http://legal.us.ubm.com/privacy-policy/
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: http://reg.ubmamevents.com/UBMLegalEntities
Title: Legal Entities

Search URL Search Domain Scan URL

URL: http://twitter.com/share/?text=&url=%3Ff%5Fsrc%3Dthissite%5Ftweetlink
Title: Tweet This

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 40

https://platform.linkedin.com/in.js HTTP 302
https://platform.linkedin.com/xdoor/scripts/in.js

Request Chain 75

https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F331&f=%2Fdarkreading%2Fsection%2F331%2F1333954&rndserial=59101 HTTP 302
https://img.deusm.com/images/spacer.gif

Request Chain 83

https://cm.everesttech.net/cm/dd?d_uuid=89066330347655179410626699228815988173 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XHRdLgAADnIC2jx0

Request Chain 88

https://rudy.adsnative.com/cm.gif HTTP 302
https://t.cwkuki.com/cs/anPaK0

Request Chain 102

https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1551129902140&ns_c=windows-1252&cv=3.1e&c8=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c7=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1551129902140&ns_c=windows-1252&cv=3.1e&c8=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c7=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&c9=

Request Chain 128

https://ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/B22221650.238408627;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/B22221650.238408627;dc_pre=CMrbzpbp1-ACFZqadwodhnoHQg;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 131

https://fpn.flipboard.com/pix/__fpn.gif?utm_source=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954 HTTP 307
https://fpn.flipboard.com/tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fthreat-intelligence%25252Fturbotax-hit-with-cyberattack-tax-returns-compromised%25252Fd%25252Fd-id%25252F1333954&rh=https%253A%252F%252Fwww.darkreading.com%252Fthreat-intelligence%252Fturbotax-hit-with-cyberattack-tax-returns-compromised%252Fd%252Fd-id%252F1333954

Request Chain 180

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=657486201&ref2=elqNone&tzo=0&ms=40&optin=disabled HTTP 302
https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=657486201&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1

Request Chain 181

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=elqNone&tzo=0&ms=40&optin=disabled HTTP 302
https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1

Request Chain 240

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

248 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 1333954 Show response
www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/ 147 KB
26 KB 418ms
381ms Document
text/html 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

37d7c37cc8dfd40699be2ce320562c04d56058103bbc6f638f956e57045ac176

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.darkreading.com
:scheme: https
:path: /threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 25 Feb 2019 21:25:01 GMT
content-type: text/html
set-cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; expires=Tue, 25-Feb-20 21:25:01 GMT; path=/; domain=.darkreading.com; HttpOnly darkreading_lastvisit=2/25/2019 4:25:01 PM; expires=Sat, 25-Feb-2034 20:25:1 GMT; path=/; HttpOnly darkreading_lastvisit=2/25/2019 4:25:01 PM; expires=Sat, 25-Feb-2034 20:25:1 GMT; path=/; HttpOnly cplChannelTagID=; path=/ darkreading%2Dmeter=1333954; expires=Tue, 26-Feb-2019 05:00:00 GMT; path=/ darkreading%5Fvisits=2; expires=Sat, 25-Feb-2034 05:00:00 GMT; path=/
vary: Accept-Encoding
cache-control: private
x-pingback: http://www.staging.new.informationweek.com/xmlrpc.asp
x-powered-by: ASP.NET
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4aed3dfa9bc39780-FRA
content-encoding: gzip

GET
H2 200 css
fonts.googleapis.com/ 2 KB
603 B 25ms
14ms Stylesheet
text/css 2a00:1450:4001:81a::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab:700

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81a::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

fafe9e0f27eece0255550c7f9869d07296a726f1cfe7db344aa9205e13b7e719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 25 Feb 2019 21:25:01 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 25 Feb 2019 21:25:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:01 GMT

GET
H2 200 darkreading.css
twimgs.com/nojitter/css/ 17 KB
3 KB 92ms
14ms Stylesheet
text/css 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/darkreading.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 09:38:14 GMT
server: cloudflare
etag: W/"45f8-54e22b7428d80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd69e6c2a6-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 pano-framework.css
www.darkreading.com/styles/ 124 KB
9 KB 18ms
8ms Stylesheet
text/css 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/styles/pano-framework.css?v1.26

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

2466b97bcdbd9ad0e026385c5767a433425243f95012cedb1712925dfe91dcb4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /styles/pano-framework.css?v1.26
pragma: no-cache
cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; darkreading_lastvisit=2/25/2019 4:25:01 PM; cplChannelTagID=; darkreading%2Dmeter=1333954; darkreading%5Fvisits=2
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 26 Nov 2018 11:03:37 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"2a1f41ae7785d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 4aed3dfcf8859780-FRA
expires: Mon, 25 Feb 2019 23:25:01 GMT

GET
H2 200 styles.css
www.darkreading.com/styles/ 292 B
306 B 22ms
11ms Stylesheet
text/css 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/styles/styles.css?v7

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

a8fc74838ba253a4076b8eb46aeed79c10341380609dcfe11bed40d974d1fd10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /styles/styles.css?v7
pragma: no-cache
cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; darkreading_lastvisit=2/25/2019 4:25:01 PM; cplChannelTagID=; darkreading%2Dmeter=1333954; darkreading%5Fvisits=2
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 03 Apr 2017 14:07:01 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"d632e39083acd21:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 4aed3dfcf88a9780-FRA
expires: Mon, 25 Feb 2019 23:25:01 GMT

GET
H2 200 dr_nativead.css
i.ubm-us.net/oas/nativead/css/ 2 KB
942 B 96ms
14ms Stylesheet
text/css 2606:4700:30::6818:7975
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/css/dr_nativead.css?v3
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:7975 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5932acd6c5f2796f354dedc5e8dfe30e206787365186bbf0f9789d083472a75

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Feb 2019 18:48:56 GMT
server: cloudflare
etag: W/"861-5813e2d913600"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
expires: Tue, 26 Feb 2019 01:25:01 GMT
cache-control: public, max-age=14400
cf-polished: origSize=2145
cf-ray: 4aed3dfd6a0263a9-FRA
cf-bgj: minify

GET
H2 200 nativead.js Show response
i.ubm-us.net/oas/nativead/js/ 1 KB
464 B 99ms
17ms Script
application/javascript 2606:4700:30::6818:7975
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/js/nativead.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:7975 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 984cd1fa5dd20c2b1b8fd77b6bb876a3a211cdf14aaaed6bc1481e3c98027544

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 30 Jul 2015 14:31:41 GMT
server: cloudflare
cf-polished: origSize=1373
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Tue, 26 Feb 2019 21:25:01 GMT
cache-control: public, max-age=86400
cf-ray: 4aed3dfd6a0363a9-FRA
cf-bgj: minify

GET
H2 200 dr_nativead.js Show response
i.ubm-us.net/oas/nativead/js/ 8 KB
1 KB 96ms
15ms Script
application/javascript 2606:4700:30::6818:7975
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/js/dr_nativead.js?v3
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:7975 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 06 Oct 2017 16:50:20 GMT
server: cloudflare
cf-polished: origSize=8434
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Tue, 26 Feb 2019 21:25:01 GMT
cache-control: public, max-age=86400
cf-ray: 4aed3dfd6a0463a9-FRA
cf-bgj: minify

GET
H2 200 respond.min.js Show response
www.darkreading.com/script/ 4 KB
2 KB 22ms
12ms Script
application/x-javascript 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/respond.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /script/respond.min.js
pragma: no-cache
cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; darkreading_lastvisit=2/25/2019 4:25:01 PM; cplChannelTagID=; darkreading%2Dmeter=1333954; darkreading%5Fvisits=2
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 22 Sep 2014 21:04:30 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"03ccda8d6cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 4aed3dfcf88b9780-FRA
expires: Mon, 25 Feb 2019 23:25:01 GMT

GET
H2 200 jquery.mobile.custom.min.js Show response
www.darkreading.com/script/ 8 KB
3 KB 21ms
12ms Script
application/x-javascript 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/jquery.mobile.custom.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /script/jquery.mobile.custom.min.js
pragma: no-cache
cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; darkreading_lastvisit=2/25/2019 4:25:01 PM; cplChannelTagID=; darkreading%2Dmeter=1333954; darkreading%5Fvisits=2
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Mon, 22 Sep 2014 21:04:30 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"03ccda8d6cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 4aed3dfcf88c9780-FRA
expires: Mon, 25 Feb 2019 23:25:01 GMT

GET
H2 200 complete.js Show response
twimgs.com/nojitter/js/ 45 KB
9 KB 102ms
26ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/complete.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 06:04:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dfd69fec2a6-FRA
expires: Tue, 26 Feb 2019 21:25:01 GMT

GET
H2 200 jquery-1.11.min.js Show response
twimgs.com/nojitter/js/ 94 KB
32 KB 102ms
27ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery-1.11.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 06:05:04 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dfd69f4c2a6-FRA
expires: Tue, 26 Feb 2019 21:25:01 GMT

GET
H2 200 darkreading.js Show response
twimgs.com/nojitter/darkreading/ 27 KB
4 KB 99ms
24ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/darkreading/darkreading.js?v9
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5a37d18a14fb428d01bfe23b0e28db9b7a189e886513a7098683cb01f0929ee

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 23 Apr 2018 13:44:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dfd69fdc2a6-FRA
expires: Tue, 26 Feb 2019 21:25:01 GMT

GET
H2 200 VisitorAPI.js Show response
epromos.ubmcanon.com/ 45 KB
15 KB 97ms
14ms Script
text/javascript 2606:4700:20::6818:452
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6818:452 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa92b44ae441805b86a9603ffea3890a8df348fb2269d716c557b6970c11e9f4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 24 Apr 2018 23:42:00 GMT
server: cloudflare
etag: W/"1010b6-b435-56aa0b35ea1a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd6c0bbead-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 at.js Show response
epromos.ubmcanon.com/ 106 KB
32 KB 98ms
15ms Script
text/javascript 2606:4700:20::6818:452
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://epromos.ubmcanon.com/at.js?ormzkk
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6818:452 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42eb48be2f9f6fc91fcda10af9802cb6aa0733e2dd007c224570ae6ece3dac33

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 12 Apr 2018 15:42:52 GMT
server: cloudflare
etag: W/"1000c4-1a7c1-569a89bca3df7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd6c0cbead-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 jplayer.blue.monday.css
twimgs.com/nojitter/css/ 12 KB
3 KB 104ms
30ms Stylesheet
text/css 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/jplayer.blue.monday.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 07:28:28 GMT
server: cloudflare
etag: W/"2f89-54ec1d5e89f00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd69e8c2a6-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 style.css
twimgs.com/nojitter/css/ 912 B
393 B 100ms
26ms Stylesheet
text/css 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/style.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 07:30:36 GMT
server: cloudflare
etag: W/"390-54ec1dd89bf00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd69ecc2a6-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 jquery.jplayer.min.js Show response
twimgs.com/nojitter/js/ 48 KB
11 KB 98ms
24ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery.jplayer.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cddbf405266cd4b3e66229592e63666012dbceaaad02635af5da9d303bfd3ed1

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 11:20:55 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dfd69fbc2a6-FRA
expires: Tue, 26 Feb 2019 21:25:01 GMT

GET
H2 200 jquery.tablesorter.min.js Show response
twimgs.com/nojitter/js/ 16 KB
5 KB 97ms
24ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery.tablesorter.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b90279154254e108748dc80dd226eab336e2c320e4a40569952b46dc5d785536

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 11:21:05 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dfd69f7c2a6-FRA
expires: Tue, 26 Feb 2019 21:25:01 GMT

GET
H2 200 ubm-widget-style.css
dsimg.ubm-us.net/ubm-widget/css/ 29 KB
5 KB 100ms
15ms Stylesheet
text/css 2606:4700:30::6818:7975
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://dsimg.ubm-us.net/ubm-widget/css/ubm-widget-style.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:7975 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e97210e22581e4b07521a644b8874bf38e72bf51fb77691c4394aecbac3081b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Apr 2018 16:31:21 GMT
server: cloudflare
etag: W/"7393-569952b4c0840"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd7a2363a9-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 ubm-widget-min.js Show response
dsimg.ubm-us.net/ubm-widget/js/ 192 KB
50 KB 112ms
27ms Script
application/javascript 2606:4700:30::6818:7975
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:7975 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Apr 2018 17:29:33 GMT
server: cloudflare
etag: W/"2fe99-56995fb6fbbe3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd7a2463a9-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 ng_forms.js Show response
www.darkreading.com/script/ 31 KB
7 KB 17ms
10ms Script
application/x-javascript 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/ng_forms.js?v7.9

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

c85a0459dea5ca94496b30f7dbd4121bcac56fb77bb48059e3c1906806b33f5c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /script/ng_forms.js?v7.9
pragma: no-cache
cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; darkreading_lastvisit=2/25/2019 4:25:01 PM; cplChannelTagID=; darkreading%2Dmeter=1333954; darkreading%5Fvisits=2
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
last-modified: Wed, 10 Oct 2018 09:37:18 GMT
server: cloudflare
x-powered-by: ASP.NET
etag: W/"5d057d67c60d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 4aed3dfcf88f9780-FRA
expires: Mon, 25 Feb 2019 23:25:01 GMT

GET
H2 200 widget-extra.css
twimgs.com/nojitter/css/ 443 B
294 B 94ms
21ms Stylesheet
text/css 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/widget-extra.css?v1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Sep 2017 07:28:37 GMT
server: cloudflare
etag: W/"1bb-5590d1ba81340"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd69efc2a6-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 render.v1.js Show response
static.adsnative.com/static/js/ 58 KB
18 KB 53ms
7ms Script
application/javascript 151.139.239.5
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsnative.com/static/js/render.v1.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.239.5 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 6f15e73a7ab391b586b6f91cc44e85f9263a80183c33a082b42dc018c71a0635

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
last-modified: Fri, 08 Feb 2019 20:30:09 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 2787AC0E36A24F64
etag: W/"5efd1cc923b6d16b380280fb6cfe5bd7"
x-cache: HIT
content-language: en
status: 200
content-type: application/javascript
access-control-allow-origin: *
x-amz-version-id: Ifq5xn.ndxora.NMSlERCxvrnLtjLs1b
x-amz-id-2: HztpElOWyxAR5bWbRlH636qNYkyMWHlBpFm9NkdHi5lVM+mvhDWEPecJISUOu2FF0npz968ddgQ=

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 24 KB
9 KB 23ms
17ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

75d29aad4bddee7c54763e562f7472d818cf09f4b86c6be0dd29a404f39c37a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 9258
x-xss-protection: 1; mode=block
server: cafe
etag: 12210022506209789712
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 25 Feb 2019 21:25:01 GMT

GET
H2 200 iwk-it-network-dr.gif
img.deusm.com/darkreading/ 3 KB
3 KB 110ms
29ms Image
image/gif 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/iwk-it-network-dr.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
cf-cache-status: HIT
last-modified: Wed, 02 Nov 2016 13:53:05 GMT
server: cloudflare
etag: "abc-54051c29ab240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3dfd7f6e2750-FRA
content-length: 2748

GET
H2 200 DR_mobile_User_nav.png
img.deusm.com/darkreading/ 1 KB
2 KB 92ms
12ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_mobile_User_nav.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "5be-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dfd7f702750-FRA
content-length: 1470

GET
H2 200 spacer.gif
img.deusm.com/images/ 49 B
169 B 24ms
12ms Image
image/gif 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2000 01:54:07 GMT
server: cloudflare
etag: "31-3737c29f20dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79052750-FRA
content-length: 49

GET
H2 200 DR_search.png
img.deusm.com/darkreading/ 2 KB
2 KB 25ms
14ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_search.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "7e9-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79062750-FRA
content-length: 2025

GET
H2 200 DR_mobile_SM.png
img.deusm.com/darkreading/ 2 KB
2 KB 24ms
13ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_mobile_SM.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "864-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79072750-FRA
content-length: 2148

GET
H2 200 DR-sections-nav.png
img.deusm.com/darkreading/ 2 KB
2 KB 24ms
13ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-sections-nav.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
etag: "9aa-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79082750-FRA
content-length: 2474

GET
H2 200 mobile_close.jpg
img.deusm.com/darkreading/ 2 KB
2 KB 24ms
13ms Image
image/jpeg 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/mobile_close.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Thu, 13 Mar 2014 12:44:20 GMT
server: cloudflare
etag: "638-4f47c4fdf5100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79092750-FRA
content-length: 1592

GET
H2 200 DR_logo_314x49.png
img.deusm.com/darkreading/ 7 KB
7 KB 24ms
13ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_logo_314x49.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0615fb751c4db849533b1e432f05428e307591466902876f8ab30d7873b7f38b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Mon, 15 Oct 2018 10:02:43 GMT
server: cloudflare
etag: "1b78-5784189c2b6f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff790a2750-FRA
content-length: 7032

GET
H2 200 DR_Join_Interop_V2.png
img.deusm.com/darkreading/ 3 KB
3 KB 24ms
14ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_Join_Interop_V2.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d752f713e203c62dbc776dd030354ceb8337f0fc7cb07be2b2f905119b177221

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Thu, 20 Dec 2018 17:34:15 GMT
server: cloudflare
etag: "b2c-57d778a1893c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff790d2750-FRA
content-length: 2860

GET
H2 200 dr_staff_125x125.jpg
img.deusm.com/darkreading/ 4 KB
4 KB 34ms
24ms Image
image/jpeg 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/dr_staff_125x125.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7a3bbddb3d813cb973cb639c1104e1cd2525abd97e356a46186d7832e7b0d8c

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Mon, 07 Nov 2016 15:44:59 GMT
server: cloudflare
etag: "f0b-540b7e7ff14c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff790e2750-FRA
content-length: 3851

GET
H2 200 DR-comment.png
img.deusm.com/darkreading/ 1011 B
1 KB 31ms
22ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:02 GMT
server: cloudflare
etag: "3f3-4f2ebd20ac480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff790f2750-FRA
content-length: 1011

GET
H2 200 thumbs-up.png
img.deusm.com/darkreading/ 2 KB
2 KB 30ms
20ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/thumbs-up.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 16:09:21 GMT
server: cloudflare
etag: "607-4f4934ae90e40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79102750-FRA
content-length: 1543

GET
H2 200 thumbs-down.png
img.deusm.com/informationweek/ 2 KB
2 KB 30ms
21ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/thumbs-down.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Nov 2013 19:20:31 GMT
server: cloudflare
etag: "624-4eba0acaa9dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79122750-FRA
content-length: 1572

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 93 KB
28 KB 10ms
8ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/418F) /
Resource Hash: 0e07e3d6ad76ab0709eadac430a14cb29751ba0a7bd2dc680bda12f1df02779e

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Feb 2019 17:42:52 GMT
Server: ECS (fcn/418F)
Etag: "c54a20b3c9ac265efb0470cdf91aff7f+gzip"
Vary: Accept-Encoding
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=1800
Content-Type: application/javascript; charset=utf-8
Content-Length: 28030

GET
H2 200 flipboard_srsw.png
cdn.flipboard.com/badges/ 322 B
745 B 16ms
7ms Image
image/png 2600:9000:200d:fc00:e:5a70:ca47:86e1
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flipboard.com/badges/flipboard_srsw.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:fc00:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44fc0a3d10c47ae5aa6c77c76b4b8f81aa08022ca464ef235005ddd86570eb5b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 01:31:43 GMT
via: 1.1 41903dc3828cdce2b3daa3c944827b92.cloudfront.net (CloudFront)
last-modified: Wed, 07 Feb 2018 22:03:59 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1518040945/ctime:1518040834/gid:20/gname:staff/md5:37351783e1813119a3e0710c16137273/mode:33152/mtime:1518064798/uid:502/uname:jlee
age: 71600
etag: "37351783e1813119a3e0710c16137273"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 322
x-amz-cf-id: Sz9UiwXcBQ6pBqxv-96-NELoKRUHz4BwfOtPHq8rThKxiJEG0QvezQ==

GET
H2 200 flbuttons.min.js Show response
cdn.flipboard.com/web/buttons/js/ 7 KB
4 KB 60ms
14ms Script
application/javascript 2600:9000:200d:fc00:e:5a70:ca47:86e1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flipboard.com/web/buttons/js/flbuttons.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:fc00:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8e7ad8de87781f6ad65b36a7d3243b44d80dc182df6af076484a2bec85051550

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 03:42:35 GMT
content-encoding: gzip
last-modified: Wed, 11 Oct 2017 00:24:00 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:502/gname:staff/uname:alee/gid:20/mode:33188/mtime:1507680760/atime:1507680783/md5:ec6e4306e5e274d25c4f9afde663da81/ctime:1507680760
age: 76248
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-id: wx2yCWw0Lh3Qml43sFc--upBroSmWqk2qJdYkB6x2naN_7GC5LdwUw==
via: 1.1 41903dc3828cdce2b3daa3c944827b92.cloudfront.net (CloudFront)

GET
H2

200

in.js Show response
platform.linkedin.com/xdoor/scripts/
Redirect Chain

https://platform.linkedin.com/in.js
https://platform.linkedin.com/xdoor/scripts/in.js

181 KB
55 KB

7ms
7ms

Script
text/javascript

2606:2800:234:b6ab:6556:9a85:ba61:ee81
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/xdoor/scripts/in.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:b6ab:6556:9a85:ba61:ee81 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40FB) /
Resource Hash: 3e51950a6b89f8f96238b48f66fc0010c55fecd7ef2e3d99aed16201320cbb1f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
x-cdn-client-ip-version: IPV6
x-cdn: ECST
x-cache: HIT
status: 200
x-cdn-proto: HTTP2
x-li-pop: prod-tln1
content-length: 55956
x-li-uuid: nddsazG4hhXAqZaLpCsAAA==
last-modified: Mon, 25 Feb 2019 21:20:44 GMT
server: ECS (fcn/40FB)
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=900
accept-ranges: bytes
x-li-proto: http/1.1
x-li-fabric: prod-lor1
expires: Mon, 25 Feb 2019 21:35:44 GMT

Redirect headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
x-cdn-client-ip-version: IPV6
x-cdn: ECST
x-cache: MISS
p3p: CP="CAO CUR ADM DEV PSA PSD OUR"
status: 302
x-cdn-proto: HTTP2
x-li-pop: prod-ela1
x-li-uuid: XDr6bW24hhXAysfsRSsAAA==
server: Apache-Coyote/1.1
vary: Accept-Encoding
x-li-fabric: prod-lor1
location: https://platform.linkedin.com/xdoor/scripts/in.js
cache-control: max-age=31536000
x-li-proto: http/1.1
expires: Tue, 25 Feb 2020 21:25:01 GMT

GET
H2 200 INT19-Logo-HorizDates-3035.png
img.deusm.com/darkreading/MarilynCohodas/ 7 KB
7 KB 23ms
14ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/MarilynCohodas/INT19-Logo-HorizDates-3035.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f95e67a383d9303db5f3d27bb1e8d0a155f881dbd89edf15cda37fba28e67bc1

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 01 Feb 2019 18:57:42 GMT
server: cloudflare
etag: "1cc4-580d9b7b67744"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79132750-FRA
content-length: 7364

GET
H2 200 DR-user.jpg
img.deusm.com/darkreading/ 2 KB
2 KB 29ms
20ms Image
image/jpeg 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-user.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d4b95126382745e9e07d76812e3bbc8d6de2cfa6356c586f930ece7d4acb8052

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Tue, 04 Mar 2014 15:58:18 GMT
server: cloudflare
etag: "97d-4f3c9f8faba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79142750-FRA
content-length: 2429

GET
H2 200 safran-desai.png
img.deusm.com/darkreading/authors/ 43 KB
44 KB 39ms
30ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/authors/safran-desai.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d574aac518d01e853f2df2792c1b202ff69282c704b4e5622dfbcf22a2767879

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Feb 2019 13:43:55 GMT
server: cloudflare
etag: "ad72-58162266cdcc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79172750-FRA
content-length: 44402

GET
H2 200 Robert-Lemos.png
img.deusm.com/darkreading/authors/ 45 KB
46 KB 23ms
14ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/authors/Robert-Lemos.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87cdbacb358e421a482bc1a52dc9cfc04a9f6d8dfe86c7c6c66bcde013792850

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Wed, 12 Dec 2018 13:37:24 GMT
server: cloudflare
etag: "b5d4-57cd34c52ed00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79182750-FRA
content-length: 46548

GET
H2 200 Sheridan-IWK-125x125.jpg
img.deusm.com/informationweek/ 17 KB
17 KB 30ms
21ms Image
image/jpeg 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/Sheridan-IWK-125x125.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88f6b155f6df559c17b78785558ec29de6429ef62232a26ad2ddbf8f8de07209

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Aug 2014 20:09:58 GMT
server: cloudflare
etag: "4206-5009c7d249180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff791a2750-FRA
content-length: 16902

GET
H2 200 NL-icon.png
img.deusm.com/informationweek/ 3 KB
3 KB 38ms
29ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/NL-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2013 15:09:43 GMT
server: cloudflare
etag: "a27-4eaabc5a3dbc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff791b2750-FRA
content-length: 2599

GET
H2 200 ubm-tech.png
img.deusm.com/darkreading/ 7 KB
7 KB 43ms
35ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/ubm-tech.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b6908c1ddefad4b526966ba3f51d6e03f1f40747b658fbe64b9e3471ce6faf8

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Tue, 25 Feb 2014 18:55:37 GMT
server: cloudflare
etag: "1cb3-4f33fa2395c40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff791c2750-FRA
content-length: 7347

GET
H2 200 video-arrow_left_off.gif
img.deusm.com/darkreading/ 1 KB
1 KB 30ms
22ms Image
image/gif 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/video-arrow_left_off.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 16:02:37 GMT
server: cloudflare
etag: "53e-4f49332d48140"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff791f2750-FRA
content-length: 1342

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/0ad17f2e-83b0-4817-9f85-83bb523f6066/main/160x90/2m39s29ms/match/ 4 KB
5 KB 65ms
9ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/0ad17f2e-83b0-4817-9f85-83bb523f6066/main/160x90/2m39s29ms/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 9c03ac026e206115e0583f90338c9dcb06ea48ad5241067a166a1c394f9ee591

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 04:35:36 GMT
Via: 1.1 e98abde3c6a5bc27d4bdd4168baa587d.cloudfront.net (CloudFront)
Age: 60566
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: ufoz4ZNzlCMe43IKj2q3aM4HFFXcg6ZignEyaAGOosLr16wDZXoROg==

GET
H2 200 comment.png
img.deusm.com/informationweek/ 1 KB
1 KB 28ms
20ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Nov 2013 19:22:53 GMT
server: cloudflare
etag: "446-4eba0b5215d40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79202750-FRA
content-length: 1094

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/a8e7c148-a432-459e-8181-ba378d8da6c1/1e828d79-2292-4df0-835e-ce200355dc3e/160x90/match/ 3 KB
3 KB 65ms
9ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/a8e7c148-a432-459e-8181-ba378d8da6c1/1e828d79-2292-4df0-835e-ce200355dc3e/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 9dc3847fd8d296e1570d5b6752b4d9e3044993257b2f0e4bd5cfdedcf61e0f59

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:05 GMT
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
Age: 21897
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: fENsl8s3cKIqEF9LyBnQ8Sg5v-RJV1e0fNPpKKjXosoWXaO3lVte2Q==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/7882da0f-da1d-4785-96ab-c55ef8ee63de/a3978046-d9ef-4024-aa8d-eae6b8da0f45/160x90/match/ 3 KB
3 KB 65ms
10ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/7882da0f-da1d-4785-96ab-c55ef8ee63de/a3978046-d9ef-4024-aa8d-eae6b8da0f45/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 7e92cb972a0c5c33a960ba9135f7542284b23c9e51fba36b3ae77dd170fd65c5

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:05 GMT
Via: 1.1 a34515b3e30311d9ca27fafd4440ec95.cloudfront.net (CloudFront)
Age: 21897
X-Powered-From: us-east-1e
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: oRGGRrGmHU-p6A7yqS83gE08rSjIiv1LH8YZFbGGpYJIkCkYyul06Q==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/f2fdd737-6d3e-4c36-a8b8-cdacb607bc8a/5de61e8d-e394-4f66-a277-4278da525064/160x90/match/ 3 KB
3 KB 65ms
9ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/f2fdd737-6d3e-4c36-a8b8-cdacb607bc8a/5de61e8d-e394-4f66-a277-4278da525064/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 7bfeae359d7815e91aee4eaa70e8b803b785c2b9ef4fbbda9eca1311274126d4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:05 GMT
Via: 1.1 c76a5a41a8483a9e5dcccdfeb87a16ca.cloudfront.net (CloudFront)
Age: 21897
X-Powered-From: us-east-1a
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: udLsfZsTrK9K7axyEc_qfijX2tk31CSXxtso4kZZF5wxIok1URnt7g==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/dd1f5a44-3ec8-465b-9575-a274ea802b3c/079b60eb-4986-4356-a850-c0cc7167e762/160x90/match/ 3 KB
4 KB 64ms
9ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/dd1f5a44-3ec8-465b-9575-a274ea802b3c/079b60eb-4986-4356-a850-c0cc7167e762/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 132e19a7feb870e59a7fd2266b90a0229d4c0f98479999303f1a5c6a2d13120f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:05 GMT
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
Age: 21897
X-Powered-From: us-east-1a
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: PPfKqsaju2MA4ywIec1xzWX_ADbK4CRaubBL-prTk6YnJkixRpnEPQ==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/b7a6fca4-04fb-4b07-9017-1025e92ceee0/57da7b4a-c38e-4c02-8d4c-bab6d1d9364e/160x90/match/ 2 KB
3 KB 64ms
8ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/b7a6fca4-04fb-4b07-9017-1025e92ceee0/57da7b4a-c38e-4c02-8d4c-bab6d1d9364e/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 4a6857f46af89d2160c950fdacccafa7d00bec93f38c90779708dc0c0625d3ed

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:05 GMT
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
Age: 21897
X-Powered-From: us-east-1e
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: GNkzP_8_-8o2cyuhO2RU_-aU7phIXuJJpbUu_QwgAewf5O7MKmcBXA==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/92828275-2d5a-4358-8803-5b8da5885232/d3c87fc5-0a46-495f-b10a-64720cfb95fe/160x90/match/ 3 KB
3 KB 10ms
8ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/92828275-2d5a-4358-8803-5b8da5885232/d3c87fc5-0a46-495f-b10a-64720cfb95fe/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: e4a73b26661f72b70c74a515c07c380f9cd673b037fd0def630c9d6ac8229fce

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:05 GMT
Via: 1.1 e98abde3c6a5bc27d4bdd4168baa587d.cloudfront.net (CloudFront)
Age: 21896
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: 4-0wfycrB45I72of-G5CLgWXZo1-B662UL5aBMcBN7o1HrTbZa8bcg==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/ecfa4cdd-511e-40f8-8c90-ea48f3c490b0/4f7f5dd1-0228-42ce-b696-155d552e5288/160x90/match/ 3 KB
4 KB 10ms
9ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/ecfa4cdd-511e-40f8-8c90-ea48f3c490b0/4f7f5dd1-0228-42ce-b696-155d552e5288/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 60f84e180d9241f98dfaac54fc319fff8be52a2977f9959b564d842ee8bc04c6

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 15:20:06 GMT
Via: 1.1 a34515b3e30311d9ca27fafd4440ec95.cloudfront.net (CloudFront)
Age: 21896
X-Powered-From: us-east-1a
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: cYOaOqltG1PsoZ_YYIqrbHeu3kqdUTCXGhLYBgAHXIPfzPlEj9itdQ==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/177ffcf5-f5e4-4b90-b127-872357b2d82d/8bfde697-77bd-4f22-8796-7f222e0b216f/160x90/match/ 3 KB
3 KB 11ms
10ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/177ffcf5-f5e4-4b90-b127-872357b2d82d/8bfde697-77bd-4f22-8796-7f222e0b216f/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: f114c01e65a025ba9b36cecae835b7d85bfaf27100a49d225b27414ca14a0bae

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 05:43:10 GMT
Via: 1.1 c76a5a41a8483a9e5dcccdfeb87a16ca.cloudfront.net (CloudFront)
Age: 56512
X-Powered-From: us-east-1c
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: 3HI_GzT66iC2EHhi3y5oltfKjPFitA4jGNMsoid1cfOAskCf3LFteQ==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/987ef41f-4071-4272-8ebc-7f113239e5d4/f022d7c9-b480-4a31-a4fc-af5ba23c8a30/160x90/match/ 3 KB
3 KB 11ms
10ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/987ef41f-4071-4272-8ebc-7f113239e5d4/f022d7c9-b480-4a31-a4fc-af5ba23c8a30/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: e7c11470406c01438564eeb2d76119d52470d572f5ae04b39cea9cc4e5ee6022

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 14:37:31 GMT
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
Age: 24451
X-Powered-From: us-east-1e
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: KjmHljyPLB4TMqWaVD1f7IS_VU23nRWXL4kECFop2YRbOesRXOiiqA==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c5a884f5-d10e-4b06-8f7e-6bc54379fe32/92db0e1c-64d8-428c-95ed-6066339ada8e/160x90/match/ 3 KB
3 KB 23ms
22ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c5a884f5-d10e-4b06-8f7e-6bc54379fe32/92db0e1c-64d8-428c-95ed-6066339ada8e/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 9860a8d4dad7b5dcc531c5ec839274a273a05786ad6b74d08d8199259bfa4509

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 14:37:31 GMT
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
Age: 24451
X-Powered-From: us-east-1c
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: q3TkLFPrkV4ZbRiB_9zmc6HDaxasYWijE5xtnxmWIIxTMw3lyJbIkQ==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/c5023478-5b52-410d-866c-439728d041a1/main/160x90/1m22s389ms/match/ 3 KB
4 KB 11ms
11ms Image
image/jpeg 54.230.203.131
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/c5023478-5b52-410d-866c-439728d041a1/main/160x90/1m22s389ms/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.203.131 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-203-131.fra50.r.cloudfront.net
Software: / BC
Resource Hash: 9b25230c2a3962d55b1535f6f8aa484d04b5d9f9164c0b9b698ab319604ec778

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 19:08:25 GMT
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
Age: 8197
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: 5HVoYBdVUBKxagT63JR144L4Q1ITCTQKGI53x1FXX-8_WSHrCml3Lg==

GET
H2 200 video-arrow_right_on.gif
img.deusm.com/darkreading/ 2 KB
3 KB 28ms
21ms Image
image/gif 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/video-arrow_right_on.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 15:55:19 GMT
server: cloudflare
etag: "9f7-4f49318b927c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79212750-FRA
content-length: 2551

GET
H2 200 JK-February-self-drivingcar.jpg
img.deusm.com/darkreading/MarilynCohodas/ 172 KB
172 KB 28ms
21ms Image
image/jpeg 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/MarilynCohodas/JK-February-self-drivingcar.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5580503887258e90db4ce59e8a65c69e07b63a92ec91286b9fd29bc3dd0be4c6

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Feb 2019 13:40:24 GMT
server: cloudflare
etag: "2af2a-5816219d94200"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79222750-FRA
content-length: 175914

GET
H2 200 DR19_Feb1_Thumbnail.JPG
dsimg.ubm-us.net/asset/405503/591693/ 58 KB
59 KB 29ms
22ms Image
image/jpeg 2606:4700:30::6818:7975
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsimg.ubm-us.net/asset/405503/591693/DR19_Feb1_Thumbnail.JPG
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:7975 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46b2c6207ab97c409fe0e2713f0d83551beb7f71a827ccd96a1efea231b08874

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Thu, 07 Feb 2019 19:38:02 GMT
server: cloudflare
etag: "e9a3-58152fb00faea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 4aed3dff7c9c63a9-FRA
content-length: 59811
expires: Tue, 26 Feb 2019 01:25:02 GMT

GET
H2 200 survey_jspage.asp Show response
www.darkreading.com/ 7 KB
1 KB 140ms
139ms Script
text/html 2606:4700::6811:7863
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/survey_jspage.asp?survey_id=130&cbust=14904

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7863 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

3f425dd0b2d02d28484158627724fd7f108100abed86656ae430d3f820f3068c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /survey_jspage.asp?survey_id=130&cbust=14904
pragma: no-cache
cookie: __cfduid=d4d11a8914d4aac10aed5f965af00a7861551129901; darkreading_lastvisit=2/25/2019 4:25:01 PM; cplChannelTagID=; darkreading%2Dmeter=1333954; darkreading%5Fvisits=2; check=true; piddlNGSiteReferer=/; piddlNGPageReferer=/; AMCVS_77FB1CFE532B22840A490D45%40AdobeOrg=1; AMCV_77FB1CFE532B22840A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C17953%7CMCMID%7C84603908909848643900450804844601125694%7CMCAAMLH-1551734701%7C6%7CMCAAMB-1551734701%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1551137101s%7CNONE%7CvVersion%7C3.1.2
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.darkreading.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
server: cloudflare
x-frame-options: SAMEORIGIN
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
status: 200
cache-control: private
set-cookie: darkreading_lastvisit=2/25/2019 4:25:02 PM; expires=Sat, 25-Feb-2034 20:25:2 GMT; path=/; HttpOnly darkreading%5Fvisits=3; expires=Sat, 25-Feb-2034 05:00:00 GMT; path=/
cf-ray: 4aed3dfe2b7e9780-FRA

GET
H2 200 DRR_ENT.JPG
twimgs.com/custom_content/ 191 KB
191 KB 18ms
11ms Image
image/jpeg 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/custom_content/DRR_ENT.JPG
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d07f1ea820b5b946f4baf83c9ca81fda8b8f43d3271ae124caf04572352fa806

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 30 Nov 2018 14:18:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 4aed3dff798fc2a6-FRA
content-length: 195490
expires: Tue, 26 Feb 2019 21:25:02 GMT

GET
H2 200 DR-bug.png
img.deusm.com/darkreading/ 1 KB
2 KB 27ms
21ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-bug.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:01 GMT
server: cloudflare
etag: "5d2-4f2ebd1fb8240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79232750-FRA
content-length: 1490

GET
H2 200 dr-footer-logo-new.jpg
img.deusm.com/darkreading/ 5 KB
5 KB 27ms
21ms Image
image/jpeg 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/dr-footer-logo-new.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04f784c83e6dde0588704c7fcc52d62e657f5b09012bb62a1d309d3adc774306

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Wed, 09 Nov 2016 07:03:32 GMT
server: cloudflare
etag: "125e-540d8dad41900"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79242750-FRA
content-length: 4702

GET
H2 200 footergreyblack.css
twimgs.com/nojitter/css/ 3 KB
757 B 92ms
25ms Stylesheet
text/css 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/footergreyblack.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4587735e3d5dc5ef5149eae835aeb69f971575da9d4a293d9bffbb1dc25afa6b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 10:50:58 GMT
server: cloudflare
etag: W/"d11-54e23bb5fe880"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dfd69f2c2a6-FRA
expires: Tue, 26 Feb 2019 01:25:01 GMT

GET
H2 200 UBM_Logo_PMS669.png
img.deusm.com/images/ 1 KB
2 KB 27ms
21ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/UBM_Logo_PMS669.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 902118c5436b3d46d79f44c3f8e7012eb9acc9b4b341e034e7bf0259aca4b425

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Thu, 16 Feb 2017 13:10:17 GMT
server: cloudflare
etag: "5c4-548a584b7e040"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79252750-FRA
content-length: 1476

GET
H2 200 elqCfg.js Show response
twimgs.com/informationweek/elqNow/ 3 KB
1 KB 13ms
12ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/informationweek/elqNow/elqCfg.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45e31bcb4f072d9f442333ad139c3085bcf881955711d866035342f3028f4558

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 04 May 2011 21:27:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dff58ddc2a6-FRA
expires: Tue, 26 Feb 2019 21:25:01 GMT

GET
H2 200 elqImg.js Show response
twimgs.com/informationweek/elqNow/ 713 B
351 B 35ms
18ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/informationweek/elqNow/elqImg.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c94ad448b05002218551938d40e2baf3617a3d56a4455729d84993a5b7b311cf

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Oct 2013 20:43:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dff7981c2a6-FRA
expires: Tue, 26 Feb 2019 21:25:02 GMT

GET
H2 200 dev_adBlockerTrack.js Show response
twimgs.com/nojitter/js/ 2 KB
809 B 21ms
9ms Script
application/javascript 2606:4700:30::681f:5172
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/dev_adBlockerTrack.js?v1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681f:5172 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9053ec3a7a0bdbdcb96173299c0ba89bc15f3134849fff570e37d6322676304

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 14 Feb 2018 09:08:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 4aed3dff7989c2a6-FRA
expires: Tue, 26 Feb 2019 21:25:02 GMT

GET
H2 200 ubm-tech-global-app-measurement.js Show response
epromos.ubmcanon.com/s_code/ 56 KB
20 KB 34ms
23ms Script
text/javascript 2606:4700:20::6818:452
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://epromos.ubmcanon.com/s_code/ubm-tech-global-app-measurement.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6818:452 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 924b3a471d549de6251aea0e74fe6eb136141d3f0a8bf001906fff933dec45d4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 14 Jul 2018 00:08:25 GMT
server: cloudflare
etag: W/"180789-df4a-570ea6525b8fa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 4aed3dff7faabead-FRA
expires: Tue, 26 Feb 2019 01:25:02 GMT

GET
H2

200

spacer.gif
img.deusm.com/images/
Redirect Chain

https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F331&f=%2Fdarkreading%2Fsection%2F331%2F1333954&rndserial=59101
https://img.deusm.com/images/spacer.gif

49 B
146 B

11ms
10ms

Image
image/gif

2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

:path: /images/spacer.gif
pragma: no-cache
cookie: __cfduid=d468b75a1e3dbe2aad357b750cbe409d01551129901
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: img.deusm.com
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
:scheme: https
:method: GET
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2000 01:54:07 GMT
server: cloudflare
etag: "31-3737c29f20dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0089e42750-FRA
content-length: 49

Redirect headers

date: Mon, 25 Feb 2019 21:25:02 GMT
server: cloudflare
status: 302
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/html
location: https://img.deusm.com/images/spacer.gif
cache-control: private
set-cookie: darkreading_lastvisit=2/25/2019 4:25:02 PM; expires=Sat, 25-Feb-2034 20:25:2 GMT; path=/; HttpOnly darkreading%5Fvisits=4; expires=Sat, 25-Feb-2034 05:00:00 GMT; path=/
cf-ray: 4aed3dff7e939780-FRA

GET
H2 200 lightreading_rating_dot_10x7.gif
img.deusm.com/lightreading/ 49 B
146 B 27ms
21ms Image
image/gif 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/lightreading/lightreading_rating_dot_10x7.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Sep 2013 21:21:36 GMT
server: cloudflare
etag: "31-4e73bd694b800"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79262750-FRA
content-length: 49

GET
H2 200 twitter_intevol_18x18.gif
img.deusm.com/darkreading/ 619 B
718 B 27ms
22ms Image
image/gif 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/twitter_intevol_18x18.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Feb 2018 10:56:35 GMT
server: cloudflare
etag: "26b-564c561c21ec0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff79272750-FRA
content-length: 619

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 362 B
1 KB 43ms
42ms XHR
application/json 34.241.198.89
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=77FB1CFE532B22840A490D45%40AdobeOrg&d_nsid=0&ts=1551129901716
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.241.198.89 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-241-198-89.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a6facfe55d875891c8b80bba2a1be254333bd22dbc8d21e2da6dfcfe6c1b3f38

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v018-03b54f367.edge-irl1.demdex.com 5.47.3.20190129122145 4ms
Pragma: no-cache
Content-Encoding: gzip
X-TID: dVRdgIEnQhQ=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.darkreading.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 833 B
562 B 22ms
16ms Script
text/javascript 2a00:1450:4001:814::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit

Requested by

Host: dsimg.ubm-us.net
URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

9ac4bc532552c09709c3bb10796a1140954fa07185f5c0890b78ad0c02fcf91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 467
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 11ms
5ms Script
text/javascript 2a00:1450:4001:825::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:825::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 2875
date: Mon, 25 Feb 2019 20:37:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 17168
expires: Mon, 25 Feb 2019 22:37:06 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 32 KB
11 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3058a687ad12f7b6a114d539329baf8195b96bd93dfc6b3a942d1012c4dfd5aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "94 / 91 of 1000 / last-modified: 1550882068"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 10670
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:01 GMT

GET
H/1.1 200
OK id Show response
ubmtech.d3.sc.omtrdc.net/ 3 B
344 B 102ms
23ms XHR
application/x-javascript 172.82.228.18
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://ubmtech.d3.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=84603908909848643900450804844601125694&ts=1551129901780
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.82.228.18 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.d3.sc.omtrdc.net
Software: Omniture DC /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Mon, 25 Feb 2019 21:25:01 GMT
Server: Omniture DC
xserver: www7162
Vary: Origin
X-C: ms-6.6.0
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: https://www.darkreading.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 3

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=XHRdLgAADnIC2jx0
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=89066330347655179410626699228815988173
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XHRdLgAADnIC2jx0

42 B
769 B

37ms
36ms

Image
image/gif

34.241.198.89
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XHRdLgAADnIC2jx0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.241.198.89 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-241-198-89.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v018-09815582b.edge-irl1.demdex.com 5.47.3.20190129122145 4ms
Pragma: no-cache
X-TID: 9NxPp4g/Tss=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Mon, 25 Feb 2019 21:25:01 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XHRdLgAADnIC2jx0
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 pubads_impl_308.js Show response
securepubads.g.doubleclick.net/gpt/ 182 KB
62 KB 82ms
41ms Script
text/javascript 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

sffe /

Resource Hash

54f11fd621e5939eb06040298235228ebe3c089d22ecaddc65ed877d1a977c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Feb 2019 18:41:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 63519
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:01 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ 113 B
178 B 16ms
15ms Script
application/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=www.darkreading.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:820::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 108
x-xss-protection: 1; mode=block

GET
H2 200 json Show response
ubm.tt.omtrdc.net/m2/ubm/mbox/ 97 B
504 B 38ms
24ms XHR
application/json 66.117.29.6
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://ubm.tt.omtrdc.net/m2/ubm/mbox/json?mbox=target-global-mbox&mboxSession=657696f7d7ad4b2d8520c82cb1d72fb1&mboxPC=&mboxPage=08724a00b55445cb8a8caab1bb6634d1&mboxVersion=1.0.0&mboxCount=1&mboxTime=1551129901887&mboxHost=www.darkreading.com&mboxURL=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&mboxReferrer=&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&mboxMCGVID=84603908909848643900450804844601125694&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCAVID=&mboxMCGLH=6&vst.trk=ubmtech.d3.sc.omtrdc.net&vst.trks=ubmtech.d3.sc.omtrdc.net&mboxMCSDID=07B7F332FF73785D-15EE95DA4888BD66
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/at.js?ormzkk
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 66.117.29.6 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: /
Resource Hash: c265aee8bf383ed2165be8d4b78103c988e6b70f5bc98ffdbbe89967c57def05

Request headers

Accept: application/json
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:01 GMT
content-type: application/json;charset=UTF-8
status: 200
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="NOI DSP CURa OUR STP COM", CP="NOI DSP CURa OUR STP COM"
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 97
x-request-id: e0cf4ce1-7f75-45af-97f2-a8e95972f9c2

GET
H/1.1 200
OK / Show response
api-cache.adsnative.com/v1/host/www.darkreading.com/ 23 B
1016 B 87ms
36ms Script
application/json 23.111.11.217
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cache.adsnative.com/v1/host/www.darkreading.com/?&callback=an_callback_lookup
Requested by: Host: static.adsnative.com
URL: https://static.adsnative.com/static/js/render.v1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bec4f2f082be46c47ba8f2398813bb3c90495d69405fa0981506b1fd13ba29d6

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:02 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
X-Cache: EXPIRED
Connection: keep-alive
CF-RAY: 4aed3dffed4264c3-FRA
Server: NetDNA-cache/2.2
Vary: Accept-Encoding, Accept-Language
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Content-Language: en
Access-Control-Allow-Origin: *
Cache-Control: max-age=900, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
X-From: frontline-production-5cc6f645fd-kr8tp
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H/1.1

204
No Content

anPaK0
t.cwkuki.com/cs/
Redirect Chain

https://rudy.adsnative.com/cm.gif
https://t.cwkuki.com/cs/anPaK0

0
196 B

352ms
116ms

Image
text/plain

54.146.200.135
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.cwkuki.com/cs/anPaK0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.200.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-146-200-135.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Connection: keep-alive
Date: Mon, 25 Feb 2019 21:25:02 GMT

Redirect headers

date: Mon, 25 Feb 2019 21:25:02 GMT
vary: Accept-Encoding
cf-cache-status: MISS
server: cloudflare
access-control-allow-origin: *
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://t.cwkuki.com/cs/anPaK0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 4aed3dfffd5064c3-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 11ms
8ms Script
application/x-javascript 23.45.99.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.99.242 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-99-242.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:02 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Tue, 26 Feb 2019 21:25:02 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 52 KB
15 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

6bb981959d783d83df88b9aa48738948c9a8a22c1a31b8cb5305d3e338ebf9a7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
x-fb-debug: j5BUy3nyXUSX3w0dTSPrBJvoeO77/rN9y6oL9YhWvC+/+jVe12df9126LgxBYQI908jo/lIqQ+xvfo+RTkl4Lg==
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 25 Feb 2019 21:25:02 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
status: 200
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
strict-transport-security: max-age=31536000; preload; includeSubDomains
vary: Accept-Encoding
content-length: 15216
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 log.js Show response
u.heatmap.it/ 26 KB
10 KB 47ms
9ms Script
application/x-javascript 46.105.202.39
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u.heatmap.it/log.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: ecded18536426e30f5af01e39779ff4f66c52fd762ba75729188b80e37f7cfac

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: br
last-modified: Thu, 25 Oct 2018 10:53:36 GMT
x-cdn-pop-ip: 137.74.120.0/27
etag: W/"5bd1a0b0-6804"
x-cacheable: Matched cache
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
status: 200
cache-control: max-age=2592000
x-cdn-pop: sbg
accept-ranges: bytes
content-length: 10194
expires: Sat, 23 Feb 2019 14:56:22 GMT

GET
H2 200 background-pattern.png
img.deusm.com/darkreading/ 493 B
569 B 34ms
29ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/background-pattern.png
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:01 GMT
server: cloudflare
etag: "1ed-4f2ebd1fb8240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3dff89282750-FRA
content-length: 493

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
16 KB 191ms
190ms XHR
text/plain 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2152826736962338&correlator=92575648923917&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21062577%2C21062818%2C21063015%2C21063065&vrg=308&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-32&iu_parts=2441%2Cdarkreading%2Cthreat_intelligence&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=2x2%2C5x5%2C300x250%7C336x280%7C300x600%7C336x850%2C6x6%2C1x2%2C728x90%7C970x250%2C336x27%2C300x250%7C336x280%7C300x600%7C336x850%2C300x60%2C3x3%2C4x4%2C8x2%2C8x4&prev_scp=pos%3Dwelcome%7Cpos%3DTAPunit%7Cpos%3Drec1%7Cpos%3Dpromo%7Cpos%3Dwallpaper%7Cpos%3Dtop%7Cpos%3Dlogo%7Cpos%3Drec2%7Cpos%3Deventpromo%7Cpos%3Dribbon%7Cpos%3Dvideo%7Cpos%3Dnative%7Cpos%3Dinsight&cust_params=kw%3DAttacks%252CAttacks-Breaches%252CBreaches%252CEndpoint%252CEndpoint_Security%26aid%3D1333954&cookie_enabled=1&bc=15&abxe=1&lmt=1551129902&dt=1551129902000&dlt=1551129901579&idt=353&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=0%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=2939462539%2C1978988809%2C1970779331%2C2358655773%2C2890945858%2C4212726612%2C2547694139%2C1970779328%2C1767311320%2C1264623177%2C1580033366%2C1909009090%2C3277028592&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&dssz=38&icsg=16106140320&std=0&csl=93&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x1200%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=1600x2%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&blev=1&bisch=1&ga_vid=1412618063.1551129902&ga_sid=1551129902&ga_hid=1559424857&fws=0%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

005fb0400987f0ec2ca49cfde00047805aad0941c8f2b760ae756587bae636c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 16124
x-xss-protection: 1; mode=block
google-lineitem-id: 140048676,4886432395,4886432395,-2,4886432395,4965675797,-2,4969789565,-2,-2,42403476,4922749154,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 96102516636,138257822908,138257559129,-2,138257822911,138260692446,-2,138261325138,-2,-2,138212589663,138257449132,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_308.js Show response
securepubads.g.doubleclick.net/gpt/ 67 KB
25 KB 42ms
41ms Script
text/javascript 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

sffe /

Resource Hash

d58f7e95bf8f6784186de8e32db1ab79e9e3521a17494dfefc8b30e7f4475a73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Feb 2019 18:41:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 25416
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-32/html/ 0
0 19ms
6ms Other
text/html 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-32/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Purpose: prefetch
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:81a::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/?random=1551129902111&cv=9&fst=1551129902111&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&tiba=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

9af9477e22eabfdb62baa0d660360ca03fa96fbab4d05d63a81935f14dbe2ae8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 981
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 22 KB
7 KB 34ms
32ms Script
application/javascript 204.79.197.200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.79.197.200 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: a-0001.a-msedge.net
Software: /
Resource Hash: 9e03d610493a32cfa7a9750ac0c194f807c46926270e565fc8b41ee71053a52d

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:01 GMT
content-encoding: gzip
last-modified: Fri, 04 Jan 2019 00:35:47 GMT
x-msedge-ref: Ref A: 3914B92C306A48A78876188F693AB52B Ref B: FRAEDGE1115 Ref C: 2019-02-25T21:25:02Z
access-control-allow-origin: *
etag: "80b3316fc5a3d41:0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 6891

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

2eeb22c5a235ff40df2bc4dd3487d90a6a97a889d066197ae6fcc10614d0c544

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: JSbabed7TXC2a6iuJ5CpFg==
status: 200
vary: Accept-Encoding
content-length: 1745
x-xss-protection: 0
x-fb-debug: vbllgFSGwJ6xbMFT+J3bcbGweZsCfFjmxg8bR5orA5/y217ceUwxEBwNjzV2OmexbgcKAAISAmfXie/pZY/lHw==
x-fb-content-md5: 5b2e12414ca4e31cb84bfe8aef068021
date: Mon, 25 Feb 2019 21:25:02 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
access-control-allow-credentials: true
etag: "d27e916da551a519d58b03677e8d61f1"
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
timing-allow-origin: *
expires: Mon, 25 Feb 2019 21:36:18 GMT

GET
H/1.1 200
OK Cookie set dest5.html
ubm.demdex.net/ Frame BED7 0
0 152ms
32ms Document
text/html 52.49.47.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ubm.demdex.net/dest5.html?d_nsid=0
Requested by: Host: epromos.ubmcanon.com
URL: https://epromos.ubmcanon.com/VisitorAPI.js?ormzkk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.47.75 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-47-75.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Host: ubm.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Accept-Encoding: gzip, deflate, br
Cookie: demdex=89066330347655179410626699228815988173
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Fri, 01 Feb 2019 14:32:54 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=89066330347655179410626699228815988173;Path=/;Domain=.demdex.net;Expires=Sat, 24-Aug-2019 21:25:02 GMT;Max-Age=15552000
Vary: Accept-Encoding, User-Agent
X-TID: rRSwgeoVScc=
Content-Length: 2764
Connection: keep-alive

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
101 B 14ms
13ms Image
image/gif 2a00:1450:4001:825::2008
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1795714065&utmhn=www.darkreading.com&utmcs=windows-1252&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&utmhid=1559424857&utmr=-&utmp=%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&utmht=1551129902137&utmac=UA-30302365-1&utmcc=__utma%3D199458747.1412618063.1551129902.1551129902.1551129902.1%3B%2B__utmz%3D199458747.1551129902.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=2008504822&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAQAAAAE~

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:825::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/api2/v1550471573786/ 259 KB
90 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:820::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/api2/v1550471573786/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:820::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5bea0ee3455f7e60ae32de7cda7dfd5dba2847dc80cf11818e55babcd35e361a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 22 Feb 2019 16:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Feb 2019 17:15:00 GMT
server: sffe
age: 276432
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 92125
x-xss-protection: 1; mode=block
expires: Sat, 22 Feb 2020 16:37:50 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1551129902140&ns_c=windows-1252&cv=3.1e&c8=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c7=https%3A%2F%2Fwww.darkrea...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1551129902140&ns_c=windows-1252&cv=3.1e&c8=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c7=https%3A%2F%2Fwww.darkre...

0
248 B

8ms
8ms

Image
text/plain

23.45.99.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1551129902140&ns_c=windows-1252&cv=3.1e&c8=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c7=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&c9=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.99.242 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-99-242.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:02 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1551129902140&ns_c=windows-1252&cv=3.1e&c8=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c7=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&c9=
Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:02 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 832000476880185 Show response
connect.facebook.net/signals/config/ 186 KB
45 KB 9ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/832000476880185?v=2.8.42&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

70bd52e90af60aab21171ffa262d2577d8d4064f8a4d55c1c51b6f73ff7bcc94

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 46033
x-xss-protection: 0
pragma: public
x-fb-debug: Gj6e93Mk/ZGIFsgoD5ysdhlgXf/J+EnC9JsKwEXUOU1VQ9NtrWBVql6i/Iei0wOWL6sMlCu9mSvX7IzVoNTkjQ==
date: Mon, 25 Feb 2019 21:25:02 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 www.darkreading.com.js Show response
u.heatmap.it/conf/ 0
118 B 66ms
65ms Script
text/plain 46.105.202.39
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u.heatmap.it/conf/www.darkreading.com.js
Requested by: Host: u.heatmap.it
URL: https://u.heatmap.it/log.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 204
date: Mon, 25 Feb 2019 21:25:02 GMT
x-cdn-pop: sbg
x-cacheable: Cacheable
x-cdn-pop-ip: 137.74.120.0/27
expires: Mon, 25 Feb 2019 21:30:03 GMT

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 171 KB
53 KB 8ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=f36057717eab37d531e5ba8530b3d716&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

36f685cfc0442417fc1d2999027ff92d51a68a1ebfdc75d56141b72c3d06dda4

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: qRVJiblhmipn8HiMiyGyyA==
status: 200
vary: Accept-Encoding
content-length: 54468
x-xss-protection: 0
x-fb-debug: 20AXq9Gun1tC8KXIIc/vTK0RigePvA9Y+UA9qcA4CE/SBbjFyOhvwY+CoZ65JYMjjaP99i/IcdxPlyqTH47gRg==
x-fb-content-md5: 68a83e89995834093896b2d7f5cb39ef
date: Mon, 25 Feb 2019 21:25:02 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
access-control-allow-credentials: true
etag: "346ea323aead6ba163bcd90b26e5548b"
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
timing-allow-origin: *
expires: Tue, 25 Feb 2020 21:04:05 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1007530244/ 42 B
109 B 22ms
21ms Image
image/gif 2a00:1450:4001:814::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1007530244/?random=1551129902111&cv=9&fst=1551128400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&tiba=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&fmt=3&cdct=2&is_vtc=1&random=1781272236&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1007530244/ 42 B
109 B 38ms
37ms Image
image/gif 2a00:1450:4001:81a::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1007530244/?random=1551129902111&cv=9&fst=1551128400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&tiba=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&fmt=3&cdct=2&is_vtc=1&random=1781272236&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81a::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rss-icon.png
img.deusm.com/darkreading/ 2 KB
2 KB 10ms
9ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/rss-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "649-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099ef2750-FRA
content-length: 1609

GET
H2 200 tw-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 10ms
9ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/tw-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "56e-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099f02750-FRA
content-length: 1390

GET
H2 200 flipboard-icon.png
img.deusm.com/darkreading/ 425 B
524 B 18ms
17ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/flipboard-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22c53eeed2c33c21657590793b89fed83648ee555686c0e9ff90b39c1dab406f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 30 Nov 2018 12:31:36 GMT
server: cloudflare
etag: "1a9-57be0fae8ba00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099f12750-FRA
content-length: 425

GET
H2 200 facebook-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 17ms
15ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/facebook-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "4a9-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099f32750-FRA
content-length: 1193

GET
H2 200 li-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 17ms
16ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/li-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "54b-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099f42750-FRA
content-length: 1355

GET
H2 200 reb-border.png
img.deusm.com/darkreading/ 331 B
542 B 15ms
14ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/reb-border.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Thu, 03 Nov 2016 06:29:01 GMT
server: cloudflare
etag: "14b-5405fac56e540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099f52750-FRA
content-length: 331

GET
H2 200 nav-background.png
img.deusm.com/darkreading/ 3 KB
3 KB 17ms
16ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/nav-background.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Sat, 22 Feb 2014 17:43:38 GMT
server: cloudflare
etag: "af8-4f30247448680"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e0099f72750-FRA
content-length: 2808

GET
H2 200 BngRUXZYTXPIvIBgJJSb6u92w7CGwR2oefDo.woff2
fonts.gstatic.com/s/robotoslab/v8/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v8/BngRUXZYTXPIvIBgJJSb6u92w7CGwR2oefDo.woff2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4901c9453014d8e210b2f62189f68c2d7964543517e1fc8447924de7d542058a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab:700
Origin: https://www.darkreading.com

Response headers

date: Thu, 21 Feb 2019 01:03:02 GMT
x-content-type-options: nosniff
last-modified: Tue, 19 Feb 2019 22:29:14 GMT
server: sffe
age: 418920
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11388
x-xss-protection: 1; mode=block
expires: Fri, 21 Feb 2020 01:03:02 GMT

GET
H2 204 0
bat.bing.com/action/ 0
92 B 37ms
36ms Image
text/plain 204.79.197.200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5476211&Ver=2&mid=5cfa868d-5826-2a3d-a7b3-23a384af1fb4&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=TurboTax%20Hit%20with%20Cyberattack,%20Tax%20Returns%20Compromised&p=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&r=&evt=pageLoad&msclkid=N&rn=296929
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.79.197.200 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: a-0001.a-msedge.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Mon, 25 Feb 2019 21:25:01 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: C83ED56E5429400694E782D07FE54492 Ref B: FRAEDGE1115 Ref C: 2019-02-25T21:25:02Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
244 B 7ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=832000476880185&ev=PageView&dl=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&rl=&if=false&ts=1551129902224&sw=1600&sh=1200&v=2.8.42&r=stable&ec=0&o=30&fbp=fb.1.1551129902223.1704976188&it=1551129902144&coo=false&rqm=GET
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4892 77 KB
28 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28847
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 76 KB
28 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7a57d28c747283d4ae4de161293b88b1e46949a51768f9abe0e0934e8c321130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28310
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAF4 77 KB
28 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28847
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 imgad
tpc.googlesyndication.com/pagead/ 484 KB
484 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKC79J2ADBABGAEyCANrTtaOsBRo

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

f348aaddd9411de71b51b80b9a2a596f1761af08d36f02f7778aeac1d4009b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Feb 2019 07:13:25 GMT
x-content-type-options: nosniff
server: cafe
age: 569497
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=604800
content-type: image/jpeg
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 495141
x-xss-protection: 1; mode=block
expires: Tue, 26 Feb 2019 07:13:25 GMT

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/011902081532110/ 20 KB
8 KB 26ms
14ms Script
text/javascript 2a00:1450:4001:80b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011902081532110/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:80b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a826cda262823b8ca4f27514fdd45cfa283e4bb8e946ee92ebd1caff2c602556

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: gzip
x-content-type-options: nosniff
age: 1061016
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 7911
x-xss-protection: 1; mode=block
server: sffe
date: Wed, 13 Feb 2019 14:41:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "560459346dcf3764"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Feb 2020 14:41:26 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/011902081532110/ Frame 280E 266 KB
84 KB 22ms
15ms Script
text/javascript 2a00:1450:4001:80b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:80b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9a2285a8ec601a41f5516c284c12b7675d574ef9ac56d6e3bf8a5c1d16bdec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: gzip
x-content-type-options: nosniff
age: 979601
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 86301
x-xss-protection: 1; mode=block
server: sffe
date: Thu, 14 Feb 2019 13:18:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7242e02f937d2a87"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 14 Feb 2020 13:18:21 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/011902081532110/v0/ Frame 280E 134 KB
43 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:80b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011902081532110/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:80b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

508a5b4d4a7cbc7e71d9d1760f8c8a00bcf1c7e3eb2f40b3ca0cf9c81b507ce6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: gzip
x-content-type-options: nosniff
age: 1428344
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 43030
x-xss-protection: 1; mode=block
server: sffe
date: Sat, 09 Feb 2019 08:39:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1d1a4b04f9c8e7a4"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Feb 2020 08:39:18 GMT

GET
DATA 200
OK truncated
/ Frame 280E 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 797a731a28322d2665ebbdf42c620f18b1fa51d5637431ffbc3360a16c5c53c1

Request headers

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4892 0
254 B 22ms
20ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssUT_QnL8oP7mugD5VKxcSYtAStKUi6l50OSWp8j_AAcTt0RbA-UmL_URrFUnXQQSvLZ9EzZi5xjSkfuQEjSfFQcKWXonhmzEHNhhvcGyhXh2x16vZSgpcpStyhwvLFopTUAgzwXh2dhll0IV9pEDvsZZbZEbjFS4arnGzEAQ1pBqRyvmRb0oS92P4i8d2ArwnnbDioKDM84mfL_EoE36m5rZBq3HI5wD2Nrh6953vDTsHep3YTcANuNVby8r1D70yc4Nhp9kO8FOcQ-HcuLusd5kfaNUVQVqw9x8XA8W3hCTTT_vv2BJAK9aSCpmxf4Q&sai=AMfl-YTCBI2gNjX8dSpoZ9CLKMiaplIvm6XLkJVfdLMAt1ss6VVNhL3fQLdTqSssXhCMCwzak3TAfholLVCs1rRcchkZDSqyxQoLw_WNd_OH&sig=Cg0ArKJSzP9W4FgbCZMUEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame AAF4 0
253 B 22ms
20ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuJr4T8n6H0DRq88TtO-svLa5nyI1zAKlZVJ4zrTp0eRmwidI2djQ4fg45bz_-6PZMP0WkqY5onh0p1HQpZPZZvEWa4IrvLZEYs1-0j4Vrpy5IlaCfWHxMrpQNtm2YX7_9fxz3-OoDHFX9RbnCMSvPAWj87uYmNrcHvC5l-zfaACa0AFnBTw7WpXahzhiYRvAFpnqMSqXj_BIEF5nLJxYB8MkL924PwfkEiFIB2QWxA90iqNx0z_VnjRls37OmDoZAp8wfcDXz3H4ZyhdmWcHmu9C7l9jTJGGD&sai=AMfl-YTFNk2OVyJAkgdsl4Eclv1qyyNxPJi3uBxLx16XqRE_leK0mxVW8pBSIVeH12m9zNtEU0PmfvoME0SkA98BVPaAMHyW249SPBXYxmCD&sig=Cg0ArKJSzHY_cxzE_aJWEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2

200

B22221650.238408627;dc_pre=CMrbzpbp1-ACFZqadwodhnoHQg;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/ Frame AAF4
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/B22221650.238408627;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/B22221650.238408627;dc_pre=CMrbzpbp1-ACFZqadwodhnoHQg;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_...

42 B
120 B

27ms
27ms

Image
image/gif

172.217.16.134
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/B22221650.238408627;dc_pre=CMrbzpbp1-ACFZqadwodhnoHQg;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.217.16.134 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://ad.doubleclick.net/ddm/trackimp/N30602.127711DARKREADING/B22221650.238408627;dc_pre=CMrbzpbp1-ACFZqadwodhnoHQg;dc_trk_aid=435602057;dc_trk_cid=111244260;ord=1620005057;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5502756765680881570
tpc.googlesyndication.com/simgad/ Frame 280E 52 KB
52 KB 20ms
18ms Image
image/jpeg 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5502756765680881570

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

31691334cc2c62188e648564568ffcf3fc602e2153073672f92e1b2afc96f242

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 22 Feb 2019 16:55:34 GMT
x-content-type-options: nosniff
age: 275368
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 52795
x-xss-protection: 1; mode=block
last-modified: Thu, 21 Feb 2019 16:39:17 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Feb 2020 16:55:34 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 280E 0
270 B 20ms
19ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqEsi4ny0r0v87UWXelLLspaWsacvcIaKrBDdQeOGUzbjAfZ5v8xwHdgUzWNYx-gEY7Yi9cqV-yhVGHiJNThOBiUDr7CLeRRA8j39lxcqboUrOPNvlkeMabO6qXlOJ-PdyFqEI3AP9mqxQ54StHcKGXbQ2fQ4W0zg_HhewPG9o7X3ow_ZmzT4MGexlpytL2udy93teX_8beL6nW_xOBSR-D-gVFEBLkDh1uTcDtfu74LTzDNAdUaTMg3fWiuGAwyYxqpfy0GqUcF2Nh5IdJzp-Cbo&sai=AMfl-YQxfm5gIosSHw0aSNUK2PZ54bRLCDvufW3z5QTaUada5_9JpgRvROrvnvAGWiYEEIIAoGiW5YY8p12TjenK-YsbzSFJ8Pjz6a2ilYuU&sig=Cg0ArKJSzDUd_EsgQB1fEAE&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2

200

__fpn.gif
fpn.flipboard.com/tr/
Redirect Chain

https://fpn.flipboard.com/pix/__fpn.gif?utm_source=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954
https://fpn.flipboard.com/tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fthreat-intelligence%25252Fturbotax-hit-with-cyberattack-tax-returns-compromised%25252Fd%...

35 B
341 B

7ms
7ms

Image
image/gif

2600:9000:200d:f800:14:85db:2b40:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fpn.flipboard.com/tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fthreat-intelligence%25252Fturbotax-hit-with-cyberattack-tax-returns-compromised%25252Fd%25252Fd-id%25252F1333954&rh=https%253A%252F%252Fwww.darkreading.com%252Fthreat-intelligence%252Fturbotax-hit-with-cyberattack-tax-returns-compromised%252Fd%252Fd-id%252F1333954
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:f800:14:85db:2b40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 15:19:04 GMT
via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
last-modified: Thu, 12 Oct 2017 18:19:12 GMT
server: AmazonS3
age: 108343
etag: "28d6814f309ea289f847c69cf91194c6"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 35
x-amz-cf-id: LEY9mDD7rWcoeThwoo-2WzBF7SvLZ78APYV_f0O-w7pXx5kDiS9bdw==

Redirect headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
server: CloudFront
location: /tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fthreat-intelligence%25252Fturbotax-hit-with-cyberattack-tax-returns-compromised%25252Fd%25252Fd-id%25252F1333954&rh=https%253A%252F%252Fwww.darkreading.com%252Fthreat-intelligence%252Fturbotax-hit-with-cyberattack-tax-returns-compromised%252Fd%252Fd-id%252F1333954
x-cache: LambdaGeneratedResponse from cloudfront
status: 307
cache-control: no-cache, no-store, must-revalidate
content-length: 0
x-amz-cf-id: pqc3QI5pkgmmCc6fAicX-Ai2S0FgX7xatRwxzHyykKzRedsQOf3mbQ==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 4892 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 251eca9d8b079a508f490c14cb016033509a966a23720bb032bdfef8dbaae0df

Request headers

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame AAF4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f592d2932eca5d8e07ff899a71dafd9221f11b6ec58878f856e382cc3e25630

Request headers

Response headers

Content-Type: image/png

GET
H2 200 bullet.png
img.deusm.com/informationweek/ 1 KB
1 KB 9ms
8ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/bullet.png
Requested by: Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Sat, 02 Nov 2013 00:57:26 GMT
server: cloudflare
etag: "41e-4ea272a96e980"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e020b142750-FRA
content-length: 1054

GET
H2 200 vy-MhgbfL4v.js
staticxx.facebook.com/connect/xd_arbiter/r/ Frame FAFB 0
0 74ms
18ms Document
text/html 2a03:2880:f029:16:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://staticxx.facebook.com/connect/xd_arbiter/r/vy-MhgbfL4v.js?version=44

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=f36057717eab37d531e5ba8530b3d716&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f029:16:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: staticxx.facebook.com
:scheme: https
:path: /connect/xd_arbiter/r/vy-MhgbfL4v.js?version=44
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
accept-encoding: gzip, deflate, br
cookie: fr=0w89qslfTMAe6T14x..BcdF0u...1.0.BcdF0u.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

status: 200
content-encoding: br
content-type: text/html; charset=utf-8
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
expires: Thu, 20 Feb 2020 16:19:12 GMT
cache-control: public,max-age=31536000,immutable
x-fb-debug: /LMMlZpUJwpO2koH3N/Pp/zCQ1FSWNaaJqbvUoDDPzC2UODWVH7Iml3wnlHa9p4r9CR121WNT641vKM2SSgKXw==
content-length: 11008
date: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame E0E0 77 KB
0 39ms
39ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28847
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
DATA 200
OK truncated
/ Frame E0E0 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24a8343066dfb01873c3c3d480f98a6e7268555082c333d468efb1d4304c74db

Request headers

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame E0E0 0
47 B 20ms
19ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskjDdaq16SK5UGrcsFw-5-E2et182w9ptasJFzZ7pQKA28lU2iq2llSy6Wmd8hdn0E76Bd9iL5f8RTwZa_5gUfwnNX1JXO7oUqhy39zVvORlBzZkw-URx7kqNEGcBc6Gy3isC3PVGJ3XPhEZZflNl-ou4Lco-tnLW30j-A6Fk98auyDk4zY8INmCeA9mPyTKnzQjPavFE7yEuAPsNhlSKO3xz52jN9z2aTdmFZPptWfwVIq_EEAi2ZQWRItPaejK8AkKcE6SfO8D4CV0wIXAAto51oJKA&sai=AMfl-YS-8rzckUqXawuVRB9m7niERa9wMLoEFczrf4x-EHuHqs-5Vk6xhIQtUV2l3GXGgiXlB8D_JA2MKff0ptjqrNqdnI8VrprgjtnjSCW5&sig=Cg0ArKJSzJTxAGNV3XNkEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7481 77 KB
0 39ms
39ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28847
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
DATA 200
OK truncated
/ Frame 7481 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8681e778e51dd892f7a2f3b13e8de295693faec44a653755456405021494cd1

Request headers

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7481 0
56 B 22ms
22ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvWE34CdXLFM2zTcm0ICT7H6Q3Uq2CfJuiPDLnAxRQBmYW--soDj3upf3Jivg7sJ4Yh0fXHHW-P9XCfWkKCXZb1EbyCK6Q_Ihh9WVyDXE5WSXRaVpH62hIlD730gOj_0MhtsfxMYL6sMQYBM5wUPtss0ztQO0c3gjhyrwcM4dVwd3TWn5hY4LvRTSrdKFWVBoONS9EFRVXPiE-hM22Xcgc0Qksm-R-I9o2cJrOKMW44L3lMjmd9HoyNOuKvo0sfIdfOdkkqIvytzm0-Xrq2h0Qc-bFLz-cT&sai=AMfl-YR31q69S23T_Kt6P15eG9ZDPuM7pJi7h7Kfs3LeSh94-7QMyHE4af2o-T9vas39ba8zm_WQDKs006pueVdlUZcDY4snmfGug52Wgjhq&sig=Cg0ArKJSzJ_hSJkilE9tEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame C646 4 KB
2 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3b7ee503be8fb5865ba9cf4278326dc3ac1aed1e2ccaa5cc48f4894c6f692483

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:03:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 04 Feb 2019 17:31:37 GMT
server: sffe
age: 1300
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 1999
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 22:03:22 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame C646 77 KB
0 39ms
39ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28847
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame C646 0
56 B 25ms
23ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst3OgX1cvgOvrH718pm5jcP-tOnjwGvmQh84jADi63A8IzuakD5iErPvdDxFy5JI7LqZnLxsK32SJHUn-Pn-pmZjILK_5XpABr7kovE1qyMCpmn77H8C_T29DzITuLVI90dJsr-tTMBi7Rd_rMXxdI4zetCN1hwC8w9hkFH5F1q5U6WbUK-FywXVcoEAuwU9NmCOFazz6WwjoXIQp3Djsoa_3ljkSgatbiC6hBgL5BCU4wLtPzHq3ZcZwiJrqKkN0isgS-U8F5isph6gqjeNwj4CRJjR2i-&sai=AMfl-YTNuPkdSO-2EjxHmev-MbD7VJql2PmQGcSp_BitEu8VSMM_ahTFJYvUbfgmMIGcTc2TEud5zqPBONb7XB7eCwlELaYrx4PXNrnFCLt7&sig=Cg0ArKJSzADBrzmZcBCBEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 DR-hot-topics-comment.png
img.deusm.com/darkreading/ 1 KB
1 KB 12ms
11ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-hot-topics-comment.png
Requested by: Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9182e8a1e20a5437d2f311b096b2a98a33d54e94d4d9d6d01c5db3861460d04e

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:02 GMT
server: cloudflare
etag: "4a5-4f2ebd20ac480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e02bbba2750-FRA
content-length: 1189

GET
H/1.1 200
OK web.js Show response
ads.celtra.com/ad912be8/ Frame 7481 11 KB
4 KB 94ms
19ms Script
application/javascript 3.122.87.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.celtra.com/ad912be8/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuIMPr6XDf8BfXoqyAASRIBNaGSY8-5MqeOsSulhgzrwYLr8ghivSlCCztYOmuuAQS2RIUY8528RG7Fs61H0y9l7K7oBr4VQOkUOh9_SFwr5Nq5rGkDNbaIveJQbDWFlQxTEfE2ioqxG97rfT3OjTpD_IQqcaeub0iOnOG7ypwfBkFtRgvtZ_ANJbOsB8Etw9YQaXJtDpB4IHQpSb1crB-bKBOl23wIf_PTxZRhUZyqxTeBFwvjy2pFxooKJ6KVnYbDYa8cBlG__Cbe0lb2t2PKY6fe%26sai%3DAMfl-YRbuoDgHBuNS6_-JsAa9B6d7z4RHCLEMt-aBhFJnAhbvAGYho1XP1fImJeP30x5s2MzoZrSTzek9gaZaTi9H_GC5vgBEfscUFjKvibe%26sig%3DCg0ArKJSzBJyoDHRmjXXEAE%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=6&externalCreativeId=138257822908&externalPlacementId=95423676&externalSiteId=27868836&externalSiteName=darkreading.com&externalLineItemId=4886432395&externalCampaignId=2445066469&scriptId=celtra-script-1&clientTimestamp=1551129902.568&clientTimeZoneOffsetInMinutes=0&hostPageLoadId=7933106485599717
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.87.50 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-122-87-50.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 89116cf4f75bcb8ec9fc6730044fb39ec40f795b19d8a57992c5ce8c5a52c227

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:02 GMT
Content-Encoding: gzip
Content-Type: application/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 3897
Expires: 0

GET
H2 200 NL-button.png
img.deusm.com/informationweek/ 2 KB
3 KB 12ms
11ms Image
image/png 2606:4700:30::681b:8a16
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/NL-button.png
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_308.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:8a16 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.26
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2013 15:09:43 GMT
server: cloudflare
etag: "9c6-4eaabc5a3dbc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 4aed3e031bea2750-FRA
content-length: 2502

GET
H2 200 impl_v48.js Show response
www.googletagservices.com/dcm/ Frame C646 20 KB
9 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v48.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5de077b4b085d52fb6fa31cdf6060de53ab3766be16023b5bb094a2ef609cd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 14 Feb 2019 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 31 Jan 2019 01:05:47 GMT
server: sffe
age: 955814
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 8845
x-xss-protection: 1; mode=block
expires: Fri, 14 Feb 2020 19:54:48 GMT

GET
H2 200 B22221650.238349900;dc_ver=48.125;sz=300x250;u_sd=1;dc_adk=1062876990;ord=bcwwpr;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuTX5rUdZFl2A7KWtWlUxVZ75EQqd4elGY_kXy9xNDW... Show response
ad.doubleclick.net/ddm/adj/N30602.127711DARKREADING/ Frame C646 11 KB
7 KB 37ms
36ms Script
text/javascript 172.217.16.134
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N30602.127711DARKREADING/B22221650.238349900;dc_ver=48.125;sz=300x250;u_sd=1;dc_adk=1062876990;ord=bcwwpr;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuTX5rUdZFl2A7KWtWlUxVZ75EQqd4elGY_kXy9xNDW3ciBi4tBntbDlSSfdXq3NbjFZX1qvWObVktKfi-v2NL5Kf4Fj5pe2xpohay3XRZML5nLfG5sAzHJv8gNy4koa4NDsAxV9-d6ewQtqWpdDD0ID1N3VztTLnVfumwNv3bmkUejFz6P1Aom2A876KVi3vpJy77zAnGMS7sefSnLqJWxhApFObWrlKdgzd1_PK_boXwlX58jESV0g-zDN0F7F04rk_KSjJu-L9l9T1UaIvsZp_9C%26sai%3DAMfl-YQWLKMZz-DBH-Y6jwaUzjroE9ccYaO45hYIi7IiEIGD7CaPqf6eis9Wneb2TgnzwIQSpfvPajQAqcNcBlsiwGaPXIOzllaLaMAJX2d5%26sig%3DCg0ArKJSzJNVkgkN2OokEAE%26urlfix%3D1%26adurl%3D;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954$0;xdt=0;crlt=zA's!(fY9B;osda=2;sttr=41;prcl=s?

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v48.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.217.16.134 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

99fda2c1633832ff2aa402fbf04c50e37625d0fce4454865bee84c3a09c9704c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 7164
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/011902081532110/ Frame E526 266 KB
0 22ms
15ms Script
text/javascript 2a00:1450:4001:80b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:80b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9a2285a8ec601a41f5516c284c12b7675d574ef9ac56d6e3bf8a5c1d16bdec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: gzip
x-content-type-options: nosniff
age: 979601
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 86301
x-xss-protection: 1; mode=block
server: sffe
date: Thu, 14 Feb 2019 13:18:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7242e02f937d2a87"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 14 Feb 2020 13:18:21 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/011902081532110/v0/ Frame E526 134 KB
0 13ms
7ms Script
text/javascript 2a00:1450:4001:80b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011902081532110/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:80b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

508a5b4d4a7cbc7e71d9d1760f8c8a00bcf1c7e3eb2f40b3ca0cf9c81b507ce6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: gzip
x-content-type-options: nosniff
age: 1428344
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 43030
x-xss-protection: 1; mode=block
server: sffe
date: Sat, 09 Feb 2019 08:39:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1d1a4b04f9c8e7a4"
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Feb 2020 08:39:18 GMT

GET
DATA 200
OK truncated
/ Frame E526 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88c9040505b21909fd8023a7d95fb0d2d404e8e14c38dc198325c40835674315

Request headers

Response headers

Content-Type: image/png

GET
H2 200 1156826772421987421
tpc.googlesyndication.com/simgad/ Frame E526 40 KB
40 KB 8ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1156826772421987421

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

60b7702c7807c624050bc1fbc934d82a87dba7153b23009c56f78fd41545f97a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 20:27:30 GMT
x-content-type-options: nosniff
age: 3452
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 40459
x-xss-protection: 1; mode=block
last-modified: Mon, 25 Feb 2019 19:58:26 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Feb 2020 20:27:30 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame E526 0
56 B 21ms
20ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvGjk7mD0rX6JIc1peJLkOQbgoPpyIDQgLZguQRQOtZLLCd0lKIyPwM85fIRkHqJj9RVyNMGnhRof-fCj5AYw2qif__Sl_O7blosiY8FQNvnH6dSjEMSRRX11HxCZkZ3UgQnADkUtCaVrp0nCbN920UsXwx1-KHKeJpYMH421uA-3_D1mJ1aiUu4RFXHvXzIjq-6fqRH_-6sHwTsk-0bX4fLn94cXwXK3xwR2A4vZerXUtmyVRv9zQ8TPu1w8X6McrxYPD87hqmaggbJW8mGctQhwo&sai=AMfl-YSx_Jruoy_9snEW3SKGm4WrgcdpyFCnzBR-j5ix8gTaabbO_NHJwPpiuhJhvMlrPQf8I9ZFXgteInrrIFjxBebRq3QFmgDSu3PJvU-N&sig=Cg0ArKJSzPDpIp_fc7wVEAE&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C646 79 KB
28 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/lidar.js?cache=r20110914

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N30602.127711DARKREADING/B22221650.238349900;dc_ver=48.125;sz=300x250;u_sd=1;dc_adk=1062876990;ord=bcwwpr;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuTX5rUdZFl2A7KWtWlUxVZ75EQqd4elGY_kXy9xNDW3ciBi4tBntbDlSSfdXq3NbjFZX1qvWObVktKfi-v2NL5Kf4Fj5pe2xpohay3XRZML5nLfG5sAzHJv8gNy4koa4NDsAxV9-d6ewQtqWpdDD0ID1N3VztTLnVfumwNv3bmkUejFz6P1Aom2A876KVi3vpJy77zAnGMS7sefSnLqJWxhApFObWrlKdgzd1_PK_boXwlX58jESV0g-zDN0F7F04rk_KSjJu-L9l9T1UaIvsZp_9C%26sai%3DAMfl-YQWLKMZz-DBH-Y6jwaUzjroE9ccYaO45hYIi7IiEIGD7CaPqf6eis9Wneb2TgnzwIQSpfvPajQAqcNcBlsiwGaPXIOzllaLaMAJX2d5%26sig%3DCg0ArKJSzJNVkgkN2OokEAE%26urlfix%3D1%26adurl%3D;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954$0;xdt=0;crlt=zA's!(fY9B;osda=2;sttr=41;prcl=s?

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

57d21c6f607b5795c6ec757ea402750f20a88fe9d00d10287a9f22773b19a082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28691
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 V6zvOIoD.js Show response
tpc.googlesyndication.com/sodar/ Frame C646 40 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/V6zvOIoD.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

57acef388a037b38756fdd178f355217378fa2a6a9a92d0bd9655e48a9b811cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 22 Feb 2019 16:18:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Jan 2018 21:45:00 GMT
server: sffe
age: 277599
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 15146
x-xss-protection: 1; mode=block
expires: Sat, 22 Feb 2020 16:18:23 GMT

GET
H2 200 Phenomenal-Security-300x250.jpg
s0.2mdn.net/8800863/ Frame C646 519 KB
519 KB 41ms
10ms Image
image/jpeg 2a00:1450:4001:825::2006
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8800863/Phenomenal-Security-300x250.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:825::2006 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

478b3ea929d6794cd9f4bf4af9b0f959de871b7ee74c20b0b2027191fdcb5903

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 06:47:47 GMT
x-content-type-options: nosniff
last-modified: Mon, 21 Jan 2019 20:49:31 GMT
server: sffe
age: 52635
content-type: image/jpeg
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: public, max-age=86400
accept-ranges: bytes
access-control-allow-origin: *
content-length: 531356
x-xss-protection: 1; mode=block
expires: Tue, 26 Feb 2019 06:47:47 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C646 0
353 B 75ms
23ms Image
image/gif 172.217.22.66
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstofmgQQFYb5y_CXI6j5OWQodG3a7-G0VETWLYcGJcbsBWEUPvfOgJ_tFkhJXP9j5Pb_cfNbiCOEwWGbmHMpFZI1gyiyb1BJUvUCvdbA-83b5nqgsfB9I2WBSmBo-5Bk_rygiOG_ZM2Vw&sig=Cg0ArKJSzEPypt6QiBtvEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

172.217.22.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ Frame C646 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2769bd1775af61d81be3732ae80c7a8f1ad4dccd236edf54bbbcb46086d8b76f

Request headers

Response headers

Content-Type: image/png

GET
H2 200 web.js Show response
cache-ssl.celtra.com/api/creatives/83b427c8/compiled/ Frame 7481 857 KB
172 KB 74ms
12ms Script
application/javascript 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cache-ssl.celtra.com/api/creatives/83b427c8/compiled/web.js?v=109-6e2ddb5bbe&secure=1&cachedVariantChoices=W10-&inmobi=0
Requested by: Host: ads.celtra.com
URL: https://ads.celtra.com/ad912be8/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuIMPr6XDf8BfXoqyAASRIBNaGSY8-5MqeOsSulhgzrwYLr8ghivSlCCztYOmuuAQS2RIUY8528RG7Fs61H0y9l7K7oBr4VQOkUOh9_SFwr5Nq5rGkDNbaIveJQbDWFlQxTEfE2ioqxG97rfT3OjTpD_IQqcaeub0iOnOG7ypwfBkFtRgvtZ_ANJbOsB8Etw9YQaXJtDpB4IHQpSb1crB-bKBOl23wIf_PTxZRhUZyqxTeBFwvjy2pFxooKJ6KVnYbDYa8cBlG__Cbe0lb2t2PKY6fe%26sai%3DAMfl-YRbuoDgHBuNS6_-JsAa9B6d7z4RHCLEMt-aBhFJnAhbvAGYho1XP1fImJeP30x5s2MzoZrSTzek9gaZaTi9H_GC5vgBEfscUFjKvibe%26sig%3DCg0ArKJSzBJyoDHRmjXXEAE%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=6&externalCreativeId=138257822908&externalPlacementId=95423676&externalSiteId=27868836&externalSiteName=darkreading.com&externalLineItemId=4886432395&externalCampaignId=2445066469&scriptId=celtra-script-1&clientTimestamp=1551129902.568&clientTimeZoneOffsetInMinutes=0&hostPageLoadId=7933106485599717
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: b2457190882f6b0b84e494f8c42d69445c5f914ce41acfa14b1d7f791cd979bb

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 20 Feb 2019 11:48:42 GMT
content-encoding: gzip
age: 466579
x-cache: Hit from cloudfront
status: 200
content-length: 175836
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
server: Apache
etag: "07ae2cb93c9bb90577d426163a53f88facb34122e936930acb8c4a7d245b4ad6"
vary: Accept-Encoding
x-varnish: 31106296 30159594
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Lr2mWrWL0W8faF1hjFcaUFXC1w3GWg7_8yBaHhqfg4UU7CkQZYKAsw==

GET
H2 200 spacer.gif
img.lightreading.com/images/ 49 B
354 B 304ms
237ms Image
image/gif 54.230.202.82
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.lightreading.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.82 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-82.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 19:17:26 GMT
via: 1.1 fe87e98f55ed12d46a06c407f072a87e.cloudfront.net (CloudFront)
last-modified: Fri, 20 Jun 2014 19:05:53 GMT
server: AmazonS3
age: 17146
etag: "4909631c93ffa90e65247e3fd4454f2d"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 49
x-amz-cf-id: S5KFxBaroqlr5Rb1av8SzJfghqKOBMTsC339bko4n8btUcCbtLnnCQ==

GET
H2 200 6uQTKQJz.html
tpc.googlesyndication.com/sodar/ Frame BA2F 0
0 7ms
5ms Document
text/html 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/6uQTKQJz.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/V6zvOIoD.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/6uQTKQJz.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 7233
date: Fri, 08 Feb 2019 15:37:36 GMT
expires: Sat, 08 Feb 2020 15:37:36 GMT
last-modified: Tue, 02 Jan 2018 21:45:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 1; mode=block
cache-control: public, max-age=31536000
age: 1489646
alt-svc: quic=":443"; ma=2592000; v="44,43,39"

GET
H2 200 /
www.facebook.com/tr/ 44 B
98 B 9ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=832000476880185&ev=Microdata&dl=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&rl=&if=false&ts=1551129902762&cd[Schema.org]=%5B%5D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Ftwimgs.com%2Fnojitter%2Fdarkreading%2Fdr-logo.jpg%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954%22%2C%22og%3Asite_name%22%3A%22Dark%20Reading%22%2C%22og%3Adescription%22%3A%22Officials%20report%20an%20unauthorized%20party%20obtained%20tax%20return%20data%20by%20using%20credentials%20obtained%20from%20an%20outside%20source.%22%7D&cd[Meta]=%7B%22title%22%3A%22TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised%22%2C%22meta%3Adescription%22%3A%22Officials%20report%20an%20unauthorized%20party%20obtained%20tax%20return%20data%20by%20using%20credentials%20obtained%20from%20an%20outside%20source.%22%7D&cd[DataLayer]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.8.42&r=stable&ec=1&o=30&fbp=fb.1.1551129902223.1704976188&it=1551129902144&coo=false&es=automatic&rqm=GET
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
H2 200 tag Show response
a.teads.tv/page/11512/ Frame D84D 1 KB
858 B 154ms
66ms Script
application/javascript 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/11512/tag
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c5cfc527894a919282ef88af933d000c2acd9c82ff1ba41701feed18119e66ee

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
access-control-allow-origin: *
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: private, must-revalidate, max-age=3600
access-control-allow-credentials: true
content-length: 592
expires: Mon, 25 Feb 2019 22:25:02 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame D84D 77 KB
0 39ms
39ms Script
text/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_308.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1550665038146826"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 28847
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:02 GMT

GET
DATA 200
OK truncated
/ Frame D84D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c5b30ee3fd20ce526f71268280257be44da5e58c606268836dc890ac70706d87

Request headers

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame D84D 0
56 B 21ms
20ms Image
image/gif 216.58.205.226
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssPNmh5B1HWRW8eRzrAmyymTjKi3KSxRk8f4BQZqVF0vuZl1cUOBFfroC98nKS5clYD4_JF_18EV5ZzIjfMajYA4Gdnceifu9WlVJpoBAyJVZGJCkk5VABHFPjSxDWTQVdszxo6I4wacvqmUFq-IAKI27N7FMpZmtk0lro6pMZ5P5Lx3kNet4OtGisAJyAWOVTIhYzuVHWtQyPJENn5h8uTa41qqpNSCzGIJS4Yv6Ez402y2nUMqaKTwSkSQLjZW5Ju1aFjiAm6FJNGWmSOsvFtbg&sai=AMfl-YTWNDTjwx7Pyu54DSlFA0yz8ILRwJ5NDrDQIhtV8qMKqbTfTGK_FnJLWXcg08rNSKFGcJUZN14vohDTHM6OYtrNtaOTWGPb67EC7BEU&sig=Cg0ArKJSzNoPJLJZ4UsGEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:02 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 0
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK s3216362082659
ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/ 43 B
521 B 26ms
25ms Image
image/gif 172.82.228.18
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/s3216362082659?AQB=1&ndh=1&pf=1&t=25%2F1%2F2019%2021%3A25%3A2%201%200&sdid=07B7F332FF73785D-15EE95DA4888BD66&mid=84603908909848643900450804844601125694&aamlh=6&ce=UTF-8&ns=ubmtech&pageName=darkreading.com%20threat%20intelligence%20dark%20reading%20staff%20turbotax%20hit%20with%20cyberattack%2C%20tax%20returns%20compromised&g=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&cc=USD&events=event5&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&h1=Dark%20Reading%7CThreat%20Intelligence&c2=1333954&v2=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c3=Dark%20Reading%20%7C%201333954%20%7C%20TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c4=TurboTax%20Hit%20with%20Cyberattack%2C%20Tax%20Returns%20Compromised&c5=Threat%20Intelligence%20-%20Threat%20Intelligence&c7=Dark%20Reading%20Staff&c8=2a01%3A4f8%3A202%3Aa9%3A0%3A0%3A0%3A2%20%7C%20Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F67.0.3396.87%20Safari%2F537.36&v10=monday%7C4%3A00pm&c11=News%20Analysis&v12=1333954&c13=monday%7C4%3A00pm&v13=www.darkreading.com&v15=First%20Visit&c17=New&v17=New&c19=Un-Registered&c20=20190225&c22=First%20Visit&c23=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&v28=Dark%20Reading%20Staff&v37=News%20Analysis&c41=2&c48=1&v48=1&c50=2.8.2&v61=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&AQE=1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.82.228.18 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.d3.sc.omtrdc.net
Software: Omniture DC /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:02 GMT
Last-Modified: Tue, 26 Feb 2019 21:25:02 GMT
Server: Omniture DC
xserver: www7162
ETag: "3331026100555939840-5531829453535066961"
Vary: *
X-C: ms-6.6.0
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 24 Feb 2019 21:25:02 GMT

GET
H/1.1 200 Cookie set login.jsp
ng.techweb.com/authds/login/ Frame E8AE 0
0 603ms
107ms Document
text/html 2620:103::192:155:48:119
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Requested by: Host: twimgs.com
URL: https://twimgs.com/nojitter/js/jquery-1.11.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2620:103::192:155:48:119 , United States, ASN19994 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: NG /
Resource Hash

Request headers

Host: ng.techweb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

Set-Cookie: JSESSIONID=B3AB182FEAE432488B707203CBC359E4; Path=/; Secure; HttpOnly
vary: accept-encoding
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 755
Date: Mon, 25 Feb 2019 21:25:02 GMT
Server: NG
Content-Encoding: gzip
Connection: Keep-Alive

GET
H/1.1 200
OK widget_iframe.704fca4914c9b90d7a9d41abcaa19933.html
platform.twitter.com/widgets/ Frame F0C4 0
0 19ms
9ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.704fca4914c9b90d7a9d41abcaa19933.html?origin=https%3A%2F%2Fwww.darkreading.com&settingsEndpoint=https%3A%2F%2Fsyndication.twitter.com%2Fsettings
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A6) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

Content-Encoding: gzip
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Feb 2019 21:25:02 GMT
Etag: "347ce5de96d97a02c18244967b8b6532+gzip"
Last-Modified: Mon, 25 Feb 2019 17:41:11 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/41A6)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5783

GET
H/1.1 200
OK moment~timeline~tweet.6e5b62723488aee38af0c77681396a5b.js Show response
platform.twitter.com/js/ 24 KB
8 KB 40ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.6e5b62723488aee38af0c77681396a5b.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4186) /
Resource Hash: e26fdccb214e020f70cf2aede7b77d5dc51854e23b3acbb4bcff0018773a636f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Feb 2019 17:41:05 GMT
Server: ECS (fcn/4186)
Etag: "da3e8002f83d92efe615008a56f12f48+gzip"
Vary: Accept-Encoding
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=315360000
Content-Type: application/javascript; charset=utf-8
Content-Length: 7925

GET
H/1.1 200
OK timeline.e5048dcb69aab38ea88531a898d0081c.js Show response
platform.twitter.com/js/ 38 KB
11 KB 48ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.e5048dcb69aab38ea88531a898d0081c.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40AD) /
Resource Hash: ae81a5d01266cf45292b4f2ef1ab047e1dc349beb9ae07e31ab3c73071a0ebb9

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Feb 2019 17:41:05 GMT
Server: ECS (fcn/40AD)
Etag: "0ffa8e63f408dabc0ecd5e18aace108a+gzip"
Vary: Accept-Encoding
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=315360000
Content-Type: application/javascript; charset=utf-8
Content-Length: 11316

GET
H/1.1 200
OK button.dd024c345fc26f7c7a8d9938b67e5d3d.js Show response
platform.twitter.com/js/ 7 KB
3 KB 48ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.dd024c345fc26f7c7a8d9938b67e5d3d.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41AB) /
Resource Hash: bec117b5be8f22e9305be68965e3734a5135357a3ac88cda5814b7069a1c62dc

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Feb 2019 17:41:04 GMT
Server: ECS (fcn/41AB)
Etag: "481d209bbcd2464884d57a77bc64e947+gzip"
Vary: Accept-Encoding
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=315360000
Content-Type: application/javascript; charset=utf-8
Content-Length: 2293

GET
H2 200 ping
www.facebook.com/connect/ Frame 8550 0
0 48ms
35ms Document
text/html 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/connect/ping?client_id=640989409269461&domain=www.darkreading.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2Fvy-MhgbfL4v.js%3Fversion%3D44%23cb%3Df3b0247d279c02%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff129a53e5d44c6c%26relation%3Dparent&response_type=token%2Csigned_request&sdk=joey

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=f36057717eab37d531e5ba8530b3d716&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /connect/ping?client_id=640989409269461&domain=www.darkreading.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2Fvy-MhgbfL4v.js%3Fversion%3D44%23cb%3Df3b0247d279c02%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff129a53e5d44c6c%26relation%3Dparent&response_type=token%2Csigned_request&sdk=joey
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
accept-encoding: gzip, deflate, br
cookie: fr=0w89qslfTMAe6T14x..BcdF0u...1.0.BcdF0u.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
expect-ct: max-age=86400, report-uri="https://reports.fb.com/expectct/"
content-type: text/html; charset="utf-8"
x-fb-debug: cy1dr1IeJtkTBEM9SSs+5tn0mVolz3hHMpodcpszSDFzHHsWJH683VvSO61mSbUYnPQCFvllUDVCHYCVEDC1nQ==
date: Mon, 25 Feb 2019 21:25:02 GMT

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 56ms
9ms Script
application/x-javascript 184.31.90.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: twimgs.com
URL: https://twimgs.com/informationweek/elqNow/elqImg.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

184.31.90.134 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a184-31-90-134.deploy.static.akamaitechnologies.com

Software

Resource Hash

6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 30 Jan 2019 15:12:33 GMT
ETag: "fd43e839aeb8d41:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-cache, no-store
Date: Mon, 25 Feb 2019 21:25:03 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2115
Expires: Mon, 25 Feb 2019 21:25:03 GMT

GET
H2 200 like.php
www.facebook.com/plugins/ Frame C7F3 0
0 65ms
59ms Document
text/html 2a03:2880:f12d:83:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2Fvy-MhgbfL4v.js%3Fversion%3D44%23cb%3Df18fa74e9aa58c%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff129a53e5d44c6c%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=f36057717eab37d531e5ba8530b3d716&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2Fvy-MhgbfL4v.js%3Fversion%3D44%23cb%3Df18fa74e9aa58c%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff129a53e5d44c6c%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
accept-encoding: gzip, deflate, br
cookie: fr=0w89qslfTMAe6T14x..BcdF0u...1.0.BcdF0u.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
timing-allow-origin: *
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
expect-ct: max-age=86400, report-uri="https://reports.fb.com/expectct/"
content-type: text/html; charset="utf-8"
x-fb-debug: Blj5+kjn/KMgr46zJuX3BfyOX3xDuNbU6zxts+AP8br+ZLdye76UbY3uWwlaXwAnQmjC/h64kFw8B4tGXC+S5g==
date: Mon, 25 Feb 2019 21:25:03 GMT

GET
H2 200 teads-format.min.js Show response
a.teads.tv/media/format/v3/ 694 KB
184 KB 36ms
29ms Script
text/javascript 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/page/11512/tag
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 71867e5ae2dd96b5297383af1bef41ec9e75804f98bf72a672f7a45c59aa8987

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
content-encoding: gzip
last-modified: Mon, 25 Feb 2019 16:38:34 GMT
x-amz-request-id: FE0606F5A5FF8870
etag: "90dabd1d43cbc8b9d235176250a6b527"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
status: 200
cache-control: private, must-revalidate, max-age=600
x-bucket: d
accept-ranges: bytes
content-length: 187668
x-amz-id-2: QPwHZsgV/nG5pb9OhkA3zCwICCpibvNq57EUQdMRQ3Qmm742FTpPwnVnl6prcu37kLQxcO5CeFE=
expires: Mon, 25 Feb 2019 21:35:03 GMT

GET
H2 200 profile Show response
cdn.syndication.twimg.com/timeline/ 169 KB
11 KB 24ms
20ms Script
application/javascript 151.101.120.159
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_DarkReading_old&dnt=true&domain=www.darkreading.com&lang=en&screen_name=DarkReading&suppress_response_codes=true&t=1723477&tz=GMT%2B0000&with_replies=false

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.120.159 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

bb75b1b9309a7b05aa80519903f6e8c6c446fa6e5f7cf5db22ad8753612174ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=631138519
content-encoding: gzip
x-content-type-options: nosniff
age: 262
x-cache: HIT
status: 200
content-disposition: attachment; filename=jsonp.jsonp
vary: Accept-Encoding
content-length: 11130
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-served-by: cache-cdg20749-CDG
x-response-time: 167
last-modified: Mon, 25 Feb 2019 21:20:41 GMT
x-timer: S1551129903.027622,VS0,VE0
date: Mon, 25 Feb 2019 21:25:03 GMT
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
via: 1.1 varnish
cache-control: must-revalidate, max-age=300
x-connection-hash: 17d2cffaa18c1145aeadaf484e7b1118
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Feb 2019 21:25:41 GMT

GET
H2 200 syndication
syndication.twitter.com/i/jot/ 43 B
124 B 141ms
137ms Image
image/gif 104.244.42.200
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?dnt=1&l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1551129903009%2C%22dnt%22%3Atrue%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.200 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 117
pragma: no-cache
last-modified: Mon, 25 Feb 2019 21:25:03 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 25b904559beb1a13ed570fb24e74f8f1
x-transaction: 0002d20c00412105
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

svrGP.aspx
s657486201.t.eloqua.com/visitor/v200/
Redirect Chain

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=657486201&ref2=elqNone&tzo=0&ms=40&optin=disabled
https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=657486201&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1

49 B
373 B

129ms
128ms

Image
image/gif

142.0.160.13
Oracle Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=657486201&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

142.0.160.13 Redwood City, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),

Reverse DNS

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 25 Feb 2019 21:25:02 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: image/gif
Content-Length: 49
Expires: -1

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 25 Feb 2019 21:25:01 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=657486201&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 265
Expires: -1

GET
H/1.1

200
OK

svrGP.aspx
s2150.t.eloqua.com/visitor/v200/
Redirect Chain

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=elqNone&tzo=0&ms=40&optin=disabled
https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1

49 B
373 B

232ms
231ms

Image
image/gif

209.167.231.17
Oracle Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

209.167.231.17 , United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),

Reverse DNS

e017.en25.com

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 25 Feb 2019 21:25:04 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: image/gif
Content-Length: 49
Expires: -1

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 25 Feb 2019 21:25:03 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=0&ms=40&optin=disabled&elqCookie=1
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 255
Expires: -1

GET
H/1.1 200
OK tweet_button.704fca4914c9b90d7a9d41abcaa19933.en.html
platform.twitter.com/widgets/ Frame C94B 0
0 10ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.704fca4914c9b90d7a9d41abcaa19933.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40FC) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

Content-Encoding: gzip
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Feb 2019 21:25:03 GMT
Etag: "aa94a6e880501064346d446ada28a443+gzip"
Last-Modified: Mon, 25 Feb 2019 17:41:08 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40FC)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 12258

GET
H2 200 tOiGiTD6
pbs.twimg.com/card_img/1098681041198436354/ Frame 44A6 4 KB
4 KB 18ms
9ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1098681041198436354/tOiGiTD6?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4191) /

Resource Hash

e005d15369c0b86171223631c22b5c7a037c0a22459fe06cd50aec8cf0e91a76

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-response-time: 153
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
surrogate-key: card_img card_img/bucket/7 card_img/1098681041198436354
last-modified: Thu, 21 Feb 2019 20:27:07 GMT
server: ECS (fcn/4191)
access-control-allow-origin: *
x-cache: HIT
content-type: image/jpeg
status: 200
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 821455fd57813d06c526b09efc8afa81
accept-ranges: bytes
content-length: 4370

GET
H2 200 rDokcFkR
pbs.twimg.com/card_img/1099002270828630016/ Frame 44A6 4 KB
4 KB 15ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1099002270828630016/rDokcFkR?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40EA) /

Resource Hash

156236d9d1f60fb19a32bac3a9457986d914908f816409d578fb77a6eca67b41

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-response-time: 142
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
surrogate-key: card_img card_img/bucket/8 card_img/1099002270828630016
last-modified: Fri, 22 Feb 2019 17:43:34 GMT
server: ECS (fcn/40EA)
access-control-allow-origin: *
x-cache: HIT
content-type: image/jpeg
status: 200
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c0c6b9ae421c76ee7c50797a6e39fbf7
accept-ranges: bytes
content-length: 4336

GET
H2 200 5I1AVT6u
pbs.twimg.com/card_img/1098034771832246272/ Frame 44A6 3 KB
3 KB 15ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1098034771832246272/5I1AVT6u?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4192) /

Resource Hash

1f21fc94fd58412a90cffa2d2d6ae231fafaf006224654a03fe307eddd379bbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-response-time: 135
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
surrogate-key: card_img card_img/bucket/8 card_img/1098034771832246272
last-modified: Wed, 20 Feb 2019 01:39:04 GMT
server: ECS (fcn/4192)
access-control-allow-origin: *
x-cache: HIT
content-type: image/jpeg
status: 200
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: a8ecdbd85f500db162d1d402e7bee8a1
accept-ranges: bytes
content-length: 2992

GET
H2 200 RV4iCd8u
pbs.twimg.com/card_img/1097915082858610688/ Frame 44A6 7 KB
7 KB 17ms
9ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1097915082858610688/RV4iCd8u?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4190) /

Resource Hash

c1ba095f1ecd3931eaac726c19f603f2bcb7288a8fab26582637297b9c5530a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-response-time: 161
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
surrogate-key: card_img card_img/bucket/6 card_img/1097915082858610688
last-modified: Tue, 19 Feb 2019 17:43:28 GMT
server: ECS (fcn/4190)
access-control-allow-origin: *
x-cache: HIT
content-type: image/jpeg
status: 200
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 419ed434c8753201e2d0a0d0eca5e8ed
accept-ranges: bytes
content-length: 7361

GET
H/1.1 200
OK timeline.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
platform.twitter.com/css/ Frame 44A6 55 KB
13 KB 18ms
11ms Stylesheet
text/css 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A4) /
Resource Hash: 7cbb0e141a91d2c3c30c06148c1a32c2437ea6452f107a4e1fb0c032708a1295

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Feb 2019 17:41:02 GMT
Server: ECS (fcn/41A4)
Etag: "db7cf7a65ee339eb82d0f17892ef631f+gzip"
Vary: Accept-Encoding
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=315360000
Content-Type: text/css; charset=utf-8
Content-Length: 12542

GET
H/1.1 200
OK timeline.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
platform.twitter.com/css/ 55 KB
55 KB 12ms
7ms Image
text/css 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.0940efb0bc0eb82a2de893b3e7b414bf.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A4) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Feb 2019 17:41:02 GMT
Server: ECS (fcn/41A4)
Etag: "db7cf7a65ee339eb82d0f17892ef631f+gzip"
Vary: Accept-Encoding
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=315360000
Content-Type: text/css; charset=utf-8
Content-Length: 12542

GET
H2 200 A4mG0U5P_normal.jpg
pbs.twimg.com/profile_images/885169621795565573/ Frame 44A6 2 KB
2 KB 7ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/885169621795565573/A4mG0U5P_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40B4) /

Resource Hash

25b438de3e944547e69c6de98e403f46a9aa4fb98e6d1bb34954fd30ebc19b56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-response-time: 172
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
surrogate-key: profile_images profile_images/bucket/8 profile_images/885169621795565573
last-modified: Wed, 12 Jul 2017 16:08:58 GMT
server: ECS (fcn/40B4)
access-control-allow-origin: *
x-cache: HIT
content-type: image/jpeg
status: 200
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d55ccc7452238672359374eb562926b4
accept-ranges: bytes
content-length: 1883

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ Frame 44A6 44 KB
7 KB 6ms
6ms Stylesheet
text/css 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 45170
x-cache: HIT
status: 200
content-length: 6944
x-response-time: 123
surrogate-key: tfw
last-modified: Fri, 25 Jan 2019 15:01:44 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://twitter.com
x-connection-hash: 54ba9bd6ee934e70e392c1c827a27090
accept-ranges: bytes
expires: Mon, 04 Mar 2019 21:25:03 GMT

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ 44 KB
44 KB 7ms
7ms Image
text/css 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 45170
x-cache: HIT
status: 200
content-length: 6944
x-response-time: 123
surrogate-key: tfw
last-modified: Fri, 25 Jan 2019 15:01:44 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: https://twitter.com
x-connection-hash: 54ba9bd6ee934e70e392c1c827a27090
accept-ranges: bytes
expires: Mon, 04 Mar 2019 21:25:03 GMT

GET
DATA 200
OK truncated
/ Frame 44A6 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 44A6 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 44A6 644 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 439ms
104ms Image
image/gif 54.209.11.67
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjAsImNsaWVudFRpbWVzdGFtcCI6MTU1MTEyOTkwMy4xOTMsIm5hbWUiOiJjb250YWluZXJCZWNhbWVWaWV3YWJsZSJ9XX0=?crc32c=1809154331
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.11.67 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-209-11-67.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:03 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 10ms
8ms Image
image/gif 23.45.99.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1551129903441&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=90394618&cs_ucfr=1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.99.242 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-99-242.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:03 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 track
t.teads.tv/ 23 B
157 B 101ms
72ms Image
image/gif 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=placementCall&pageId=11512&pid=21882&gid=[insertionId]&slot=native&env=js-web&f=1&ts=1551129903439&fv=2.21.35
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 23
expires: Mon, 25 Feb 2019 21:25:03 GMT

GET
H2 200 track
t.teads.tv/ 23 B
157 B 101ms
73ms Image
image/gif 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=slotAvailable&pageId=11512&pid=21882&gid=[insertionId]&slot=native&env=js-web&f=1&ts=1551129903439&fv=2.21.35
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 23
expires: Mon, 25 Feb 2019 21:25:03 GMT

GET
H/1.1 200
OK index.html
cmp.teads.mgr.consensu.org/ Frame A02B 0
0 53ms
7ms Document
text/html 2a02:26f0:6c00:292::2c92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.teads.mgr.consensu.org/index.html
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:292::2c92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Host: cmp.teads.mgr.consensu.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

x-amz-id-2: kGI/LkmsIcd2daPyZ44T91Tgh3nqFBaPCP2I5Rt/ZLlg5M5DrVepYy/Ac/ZfkFjnOAPn7svobKA=
x-amz-request-id: B87A212102411FA1
Last-Modified: Fri, 14 Sep 2018 07:42:32 GMT
ETag: "e7d6c2974a38b7ff77a560e83789f66a"
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 583
Server: AmazonS3
Cache-Control: max-age=300
Expires: Mon, 25 Feb 2019 21:30:03 GMT
Date: Mon, 25 Feb 2019 21:25:03 GMT
Connection: keep-alive

GET
H2 200 imgad
tpc.googlesyndication.com/pagead/ 9 KB
9 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:81b::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKC75KLwWhABGAEyCPtUxv-q_x9A

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81b::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

8d8f7d2468648e6c710f7de999803dfe164b5364ac9ed75a0f4f44c82654d144

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 22 Feb 2019 08:31:17 GMT
x-content-type-options: nosniff
server: cafe
age: 305626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=604800
content-type: image/jpeg
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 9451
x-xss-protection: 1; mode=block
expires: Fri, 01 Mar 2019 08:31:17 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9CBB 263 B
314 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:81a::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400&text=BCDEGILORSTUVW

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81a::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e14d4e36fede709207c2745214d0d4c29d09f08df902c95997b2da292cf58f8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 25 Feb 2019 21:25:03 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 25 Feb 2019 21:25:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 21:25:03 GMT

GET
H2 200 howtobuildaSOConabudget.jpg
cache-ssl.celtra.com/api/blobs/bf6abb7dd7c84585eb3f95b50258d323af26a181fe571c36a7dcfccc54e3b7e0/ Frame 9CBB 57 KB
58 KB 12ms
12ms Image
image/jpeg 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/bf6abb7dd7c84585eb3f95b50258d323af26a181fe571c36a7dcfccc54e3b7e0/howtobuildaSOConabudget.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 65cf02310277c7d6871993c0ed709b5ad99288848f65a965c01e81b4fe1c016f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 29 Sep 2018 05:52:36 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 12929546
x-cache: Hit from cloudfront
status: 200
content-length: 58400
server: Apache
etag: "65cf02310277c7d6871993c0ed709b5ad99288848f65a965c01e81b4fe1c016f"
x-varnish: 20007238
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: xh4c6p0vGOLy3so3pr_UrTX2KEe9rUoOyIvJHT48gCs-rV6ccsbuCA==

GET
H2 200 AlienVault_Beginners%20Guide%20to%20Open%20Source%20Incident%20Response%20Tools%20Resources.jpg
cache-ssl.celtra.com/api/blobs/8d9bcc597068aefcdcd3f2c2761a53bf2646ef79f942f68fa4004dd5a12218dc/ Frame 9CBB 41 KB
42 KB 14ms
14ms Image
image/jpeg 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/8d9bcc597068aefcdcd3f2c2761a53bf2646ef79f942f68fa4004dd5a12218dc/AlienVault_Beginners%20Guide%20to%20Open%20Source%20Incident%20Response%20Tools%20Resources.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: d77331211505d7a80759e3ac50c05ea7b26544a4d5e1c74f25ecc9fbc2d99153

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 11 Jan 2019 21:18:02 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 3888420
x-cache: Hit from cloudfront
status: 200
content-length: 42389
server: Apache
etag: "d77331211505d7a80759e3ac50c05ea7b26544a4d5e1c74f25ecc9fbc2d99153"
x-varnish: 7478330 2599844
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: UuzVbn8tfNoXqmCe1wuzzqh9ulsp6w61Xl2pzn7ZhaIO7vaX7czB8w==

GET
H2 200 beginnersguidetothreatintell.jpg
cache-ssl.celtra.com/api/blobs/dffe55dec91509e5a963b302f6be41d780925724308fb174f1a81d3cc3336e6b/ Frame 9CBB 2 KB
3 KB 10ms
9ms Image
image/jpeg 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/dffe55dec91509e5a963b302f6be41d780925724308fb174f1a81d3cc3336e6b/beginnersguidetothreatintell.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 8adb798247b01b0a69cb89ba9938dd4560123aa78dc1a983f3904fba8d9484ae

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 29 Sep 2018 05:52:36 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 12929547
x-cache: Hit from cloudfront
status: 200
content-length: 2513
server: Apache
etag: "8adb798247b01b0a69cb89ba9938dd4560123aa78dc1a983f3904fba8d9484ae"
x-varnish: 25172782
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: zgAgGJMEmFCKC4tv-dtkMqLNPRbUCSuewLGAJk9unCF15N7qia4NAA==

GET
H2 200 beginnersguidetobruteforceandDDosattacks.jpg
cache-ssl.celtra.com/api/blobs/7bbdbf9f92fa010c663adefb88e923137680eb0edc0f42186d7f54d32dc83628/ Frame 9CBB 2 KB
3 KB 23ms
23ms Image
image/jpeg 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/7bbdbf9f92fa010c663adefb88e923137680eb0edc0f42186d7f54d32dc83628/beginnersguidetobruteforceandDDosattacks.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 966442844b9cf867a9c6d558ea60481788c4b050730a29a87b7139668fed26e4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 29 Sep 2018 05:52:36 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 12929547
x-cache: Hit from cloudfront
status: 200
content-length: 2501
server: Apache
etag: "966442844b9cf867a9c6d558ea60481788c4b050730a29a87b7139668fed26e4"
x-varnish: 15560643
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: JhzRoLRQG_djt32-cqxZJ1-LpLrt4s4TUIDQ85qnZqCpYy3XbxD26g==

GET
H2 200 font
fonts.gstatic.com/l/ Frame 9CBB 2 KB
2 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/l/font?kit=S6uyw4BMUTPHvxw6WQevLimqrplwqb0UmZyWWNr7bw&skey=2d58b92a99e1c086&v=v14

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

a855b14aa4fa07fff51f4d906b86222879e9720e98ad477057cb3298df36f348

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato:400&text=BCDEGILORSTUVW
Origin: https://www.darkreading.com

Response headers

date: Mon, 25 Feb 2019 13:30:27 GMT
last-modified: Wed, 11 Oct 2017 18:44:21 GMT
server: ESF
age: 28476
x-frame-options: SAMEORIGIN
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: private, max-age=86400
content-disposition: attachment; filename="font.woff2"; filename*=UTF-8''font.woff2
timing-allow-origin: *
access-control-allow-origin: *
content-length: 1812
x-xss-protection: 1; mode=block
expires: Mon, 25 Feb 2019 13:30:27 GMT

GET
H2 200 AlienVault_2018%20Threat%20Intelligence%20Report(1).jpg
cache-ssl.celtra.com/api/blobs/87787fd4779154586ac673bbf22dd978f98a8268776b960bca57e3f64f6ab825/ Frame 9CBB 75 KB
75 KB 12ms
11ms Image
image/jpeg 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/87787fd4779154586ac673bbf22dd978f98a8268776b960bca57e3f64f6ab825/AlienVault_2018%20Threat%20Intelligence%20Report(1).jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 67a054e708073422b942a6b638b1d4dd570529b471493954126e705e59fa1219

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 11 Jan 2019 20:41:03 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 3890639
x-cache: Hit from cloudfront
status: 200
content-length: 76591
server: Apache
etag: "67a054e708073422b942a6b638b1d4dd570529b471493954126e705e59fa1219"
x-varnish: 12059724 11044795
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: 2VXNVlU_6GbHDfwXZSFTc6vDgRCrR-ocQoApRxQMio71P-qOUIUrGA==

GET
H2 200 li_hover.png
cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/ Frame 9CBB 591 B
1 KB 11ms
11ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/li_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 07 Nov 2017 16:35:20 GMT
via: 1.1 varnish, 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 9521283
x-cache: Hit from cloudfront
status: 200
content-length: 591
server: Apache
etag: "c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794"
x-varnish: 2142134884
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 3njW7pYgF25916_NnGsv3j-3hVWhigpF9zakqPixKCS_YKGhTqB9Sg==

GET
H2 200 li.png
cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/ Frame 9CBB 585 B
1 KB 11ms
7ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/li.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 18 Dec 2017 08:12:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 6009145
x-cache: Hit from cloudfront
status: 200
content-length: 585
server: Apache
etag: "d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c"
x-varnish: 768925
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: X9dksqcEGA9iu2_vjy0ex51H2z90uLj7wNHkhR2fQ51FcjKFQFzQIA==

GET
H2 200 fb_hover.png
cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/ Frame 9CBB 348 B
814 B 17ms
12ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/fb_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 10:59:07 GMT
via: 1.1 varnish, 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 9368708
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39"
x-varnish: 2142601760
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: NqaKm22Iwi58TT5i5IdS5t5Qg4NaJPYoRpLSz8aJYf5vQrxvukIjdw==

GET
H2 200 fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame 9CBB 348 B
814 B 17ms
12ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 02:12:32 GMT
via: 1.1 varnish, 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 9399422
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish: 1596235338
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: qi75Q70_7neyU_U7NeRJecEWFQTCPYnRKOVusGCUP7RhnCqgfmpNYA==

GET
H2 200 tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame 9CBB 781 B
1 KB 16ms
13ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 18 Dec 2017 08:12:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 6009145
x-cache: Hit from cloudfront
status: 200
content-length: 781
server: Apache
etag: "308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish: 5839833
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: I2ME3ykaV4k4aST2P00PsGpK1o7r7Qt3_iMe6xN3u1QCb8YJanHmmw==

GET
H2 200 tw_hover.png
cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/ Frame 9CBB 777 B
1 KB 17ms
13ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/tw_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 26 Sep 2017 05:30:55 GMT
via: 1.1 varnish, 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 13189456
x-cache: Hit from cloudfront
status: 200
content-length: 777
server: Apache
etag: "1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e"
x-varnish: 1188842914
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: mSswIvxFS6G2LEnbAt7DDAVzL9R5yfwR5X6JhQ8o4CfMYwFYLjhxiw==

GET
H2 200 g%2B_hover.png
cache-ssl.celtra.com/api/blobs/02260b5f4db80947699c5410e58b39c7be2227725b7ea84612f6951decf546ec/ Frame 9CBB 920 B
1 KB 16ms
13ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/02260b5f4db80947699c5410e58b39c7be2227725b7ea84612f6951decf546ec/g%2B_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: a2d47920b183262726f3833c961cb98c24f65c396bb248c4539391d72553284e

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 18 Dec 2017 08:36:46 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 6007659
x-cache: Hit from cloudfront
status: 200
content-length: 920
server: Apache
etag: "a2d47920b183262726f3833c961cb98c24f65c396bb248c4539391d72553284e"
x-varnish: 2328471
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: B-VjQ3T6qBvoZO0D9NijKWaNji6nNiq5NBCYy8DM0o9cSSO7_wVSBw==

GET
H2 200 g%2B.png
cache-ssl.celtra.com/api/blobs/4738e9d1b0f3583df7bf47b7bd5ac0bd411deb216443aa46d443be8976fb6530/ Frame 9CBB 910 B
1 KB 16ms
14ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/4738e9d1b0f3583df7bf47b7bd5ac0bd411deb216443aa46d443be8976fb6530/g%2B.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: e48b5b18cd4fa82b4a90346da0845bf73a3d9f752fa1e173ce141a98fddeaf6f

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 18 Dec 2017 06:14:34 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 6022150
x-cache: Hit from cloudfront
status: 200
content-length: 910
server: Apache
etag: "e48b5b18cd4fa82b4a90346da0845bf73a3d9f752fa1e173ce141a98fddeaf6f"
x-varnish: 3550990 5449613
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: lBd6jPhTbeSWU93xOBdPUm0AjT750xVN6_9FulkQno0V0rMKLckZNg==

GET
H2 200 yt_hover.png
cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/ Frame 9CBB 918 B
1 KB 19ms
17ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/yt_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 08 Dec 2017 20:26:37 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 6829000
x-cache: Hit from cloudfront
status: 200
content-length: 918
server: Apache
etag: "6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677"
x-varnish: 77243550
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: bvCAQFsDhewOCadvpsaVkVb63tBnjVLpAiE1whkNALG6RjNgREd2EA==

GET
H2 200 yt.png
cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/ Frame 9CBB 914 B
1 KB 17ms
15ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/yt.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 02:40:03 GMT
via: 1.1 varnish, 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 9398584
x-cache: Hit from cloudfront
status: 200
content-length: 914
server: Apache
etag: "8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28"
x-varnish: 1057753892
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: ZzM9bRUhXOfD_-1Jasbd0uLCdK0XAHenm-mLNJQ9DFluluWbMafNQg==

POST
H2 200 r Show response
amp-error-reporting.appspot.com/ Frame E526 2 B
153 B 127ms
113ms XHR
text/plain 2a00:1450:4001:816::2014
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://amp-error-reporting.appspot.com/r
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:816::2014 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
via: 1.1 google
x-powered-by: Express
status: 200
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 2

GET
H2 200 AV.Logo.Icon%26Type.png
cache-ssl.celtra.com/api/blobs/e8808d3e0e398251ee7f5355c71100634d56a3f670012eaae9a17690db67004f/ Frame 9CBB 6 KB
7 KB 11ms
10ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/e8808d3e0e398251ee7f5355c71100634d56a3f670012eaae9a17690db67004f/AV.Logo.Icon%26Type.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 5a0e9c35f254c2b12c6f2e793d49bf238bff062822d5b25d9029fb3e6d1fc9fd

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 13 Jul 2018 18:08:04 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 19624619
x-cache: Hit from cloudfront
status: 200
content-length: 6639
server: Apache
etag: "5a0e9c35f254c2b12c6f2e793d49bf238bff062822d5b25d9029fb3e6d1fc9fd"
x-varnish: 155591727 154761202
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: AC49eiy0NifZfZvC_yuIXh012EKAARbgTEEo9XEc1kZtw29Rgx-xcw==

GET
H2 200 ad Show response
a.teads.tv/page/11512/ 118 B
338 B 73ms
73ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/11512/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=https%3A%2F%2Fwww.darkreading.com%2Fthreat-intelligence%2Fturbotax-hit-with-cyberattack-tax-returns-compromised%2Fd%2Fd-id%2F1333954&page=%7B%22id%22%3A11512%2C%22placements%22%3A%5B%7B%22id%22%3A21882%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A489%2C%22height%22%3A275%7D%2C%22slotType%22%3A%22native%22%7D%5D%2C%22gdpr_iab%22%3A%7B%22status%22%3A22%2C%22consent%22%3A%22%22%2C%22reason%22%3A220%7D%7D&userId=d031b722-12a3-44f3-ae4b-ab06dc4de21b&formatVersion=2.21.35&env=js-web&netBw=9.6&ttfb=381
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f50167bee40cd7fdd6c623efb794e0edddec7de87ef71f48c8b1b1413e1dfc4a

Request headers

Accept: application/json; charset=UTF-8
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.darkreading.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 129
expires: Mon, 25 Feb 2019 21:25:03 GMT

GET
H2 200 iframe
sync.teads.tv/ Frame FAED 0
0 95ms
71ms Document
text/html 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.teads.tv/iframe?pid=21882&userId=d031b722-12a3-44f3-ae4b-ab06dc4de21b&gdprIab={%22status%22:22,%22consent%22:%22%22,%22reason%22:220}&1551129903632
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: akka-http/10.1.5 /
Resource Hash

Request headers

:method: GET
:authority: sync.teads.tv
:scheme: https
:path: /iframe?pid=21882&userId=d031b722-12a3-44f3-ae4b-ab06dc4de21b&gdprIab={%22status%22:22,%22consent%22:%22%22,%22reason%22:220}&1551129903632
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
accept-encoding: gzip, deflate, br
cookie: tt_viewer=d6e0358d-3fea-4dac-88e2-9f7148a559e2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Response headers

status: 200
content-type: text/html; charset=UTF-8
server: akka-http/10.1.5
content-length: 1368
expires: Mon, 25 Feb 2019 21:25:03 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
set-cookie: tt_exelate=; Expires=Tue, 26 Feb 2019 21:25:03 GMT; Domain=.teads.tv tt_bluekai=; Expires=Tue, 26 Feb 2019 21:25:03 GMT; Domain=.teads.tv tt_emetriq=; Expires=Tue, 26 Feb 2019 21:25:03 GMT; Domain=.teads.tv tt_liveramp=; Expires=Tue, 26 Feb 2019 21:25:03 GMT; Domain=.teads.tv tt_neustar=; Expires=Tue, 26 Feb 2019 21:25:03 GMT; Domain=.teads.tv

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 280E 42 B
115 B 15ms
14ms Image
image/gif 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFkYElcwfnaba3d1NF8_1NThWZgMVTqWEmea0m_O_pG8wkKuD0ZzQdb0uIE1JAxKRnF8zofqyp1JDYf3jNa8v3CKZ9GH5yIWQ4Rjg&sig=Cg0ArKJSzJkbwfTPc951EAE&id=ampim&o=428,76&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1003&mtos=0,0,1003,1003,1003&tos=0,0,1003,0,0&tfs=98&tls=1101&g=100&h=100&pt=332&tt=1101&rpt=332&rst=1551129902254&r=v&adk=4212726612&avms=ampa

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4892 42 B
110 B 15ms
15ms Image
image/gif 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstH4WtG68EceW0H9SXGGx6yza7z_uC8vVCSqWKmkt-lyQT4IlZ0Gr3LmJTeBW-sCEMe0-hVw4XKZ5BtPgul_RO0hOLZeQtgcC0N1B0&sig=Cg0ArKJSzO85gpe7lenfEAE&adk=2939462539&tt=-1&bs=1585%2C1200&mtos=1087,1087,1087,1087,1087&tos=1087,0,0,0,0&p=13,0,15,2&mcvt=1087&rs=3&ht=0&tfs=191&tls=1278&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1551129902241&rpt=183&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C1526&ss=1600%2C1200&pt=-1&deb=1-3-8-12-11-29-82-9&tvt=1257&r=v&id=osdim&uc=11&upc=9&tgt=DIV&cl=1&cec=7&clc=0&cac=0&cd=2x2&v=20190220

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame AAF4 42 B
110 B 14ms
14ms Image
image/gif 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss08TN0InHZme80Ul5mki0VnA0pFvGdX_nLsiF3ynypx0DWQ2UTCEWP5Ncfpb9atLJ4swrnoIwEuwqctUePasHjKlvQ0aDoalzDWzc&sig=Cg0ArKJSzLbjew7E7sDCEAE&adk=2890945858&tt=-1&bs=1585%2C1200&mtos=1087,1087,1087,1087,1087&tos=1087,0,0,0,0&p=351,293,353,294&mcvt=1087&rs=3&ht=0&tfs=191&tls=1278&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1551129902250&rpt=217&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C1526&ss=1600%2C1200&pt=-1&deb=1-3-8-12-11-29-82-9&tvt=1257&r=v&id=osdim&uc=11&upc=9&tgt=DIV&cl=1&cec=8&clc=0&cac=0&cd=1x2&v=20190220

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 r Show response
amp-error-reporting.appspot.com/ Frame 280E 2 B
64 B 115ms
114ms XHR
text/plain 2a00:1450:4001:816::2014
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://amp-error-reporting.appspot.com/r
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:816::2014 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
via: 1.1 google
x-powered-by: Express
status: 200
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 2

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 107ms
105ms Image
image/gif 54.209.11.67
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjEsImNsaWVudFRpbWVzdGFtcCI6MTU1MTEyOTkwMy4yNjYsInNjb3BlIjoiZ2xvYmFsIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTNfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzY3LjAuMzM5Ni44NyBTYWZhcmkvNTM3LjM2Iiwib3JpZW50YXRpb24iOjAsInRvcG1vc3RSZWFjaGFibGVXaW5kb3ciOnsid2lkdGgiOjE2MDAsImhlaWdodCI6MTIwMH0sImhvc3RXaW5kb3ciOnsid2lkdGgiOjUsImhlaWdodCI6NX0sIm5lc3RpbmciOnsiaWZyYW1lIjp0cnVlLCJmcmllbmRseUlmcmFtZSI6dHJ1ZSwiaWFiRnJpZW5kbHlJZnJhbWUiOnRydWUsImhvc3RpbGVJZnJhbWUiOmZhbHNlLCJpZnJhbWVEZXB0aCI6MX0sInBhZ2VWaXNpYmlsaXR5QXBpIjp0cnVlLCJyZXF1ZXN0QW5pbWF0aW9uRnJhbWUiOnRydWUsInRvcFdpbmRvd05hdGl2ZVJBRlN1cHBvcnRlZCI6dHJ1ZSwiYWxsb3dOb25OYXRpdmVSQUZGb3JWaWV3YWJsZVRpbWVVc2VkIjpmYWxzZSwiY2xpZW50VGltZVpvbmVPZmZzZXRJbk1pbnV0ZXMiOjAsInN1cHBvcnRzQ29udGFpbmVyVmlld2FiaWxpdHkiOnRydWUsInN1cHBvcnRzQ29udGFpbmVySW5pdGlhbFZpZXdhYmlsaXR5Ijp0cnVlLCJ0YWdQYXJlbnRXaWR0aCI6NSwidGFnUGFyZW50SGVpZ2h0Ijo1LCJhbXBEZXRlY3RlZCI6ZmFsc2UsImFtcE5lc3RpbmdMZXZlbCI6IiIsInNhZmVGcmFtZURldGVjdGVkIjpmYWxzZSwiZmV0Y2hTdXBwb3J0ZWQiOnRydWUsImFzYXBFbmFibGVkIjpudWxsLCJuYXRpdmVQcm9taXNlc1N1cHBvcnRlZCI6dHJ1ZSwiYmVhY29uU3VwcG9ydGVkIjp0cnVlLCJJbnRlcnNlY3Rpb25PYnNlcnZlclN1cHBvcnRlZCI6dHJ1ZSwiaXNNdXRhdGlvbk9ic2VydmVyU3VwcG9ydGVkIjp0cnVlLCJ3ZWJWaWV3IjpudWxsLCJ0b3BXaW5kb3dMb2NhdGlvbiI6Imh0dHBzOi8vd3d3LmRhcmtyZWFkaW5nLmNvbS90aHJlYXQtaW50ZWxsaWdlbmNlL3R1cmJvdGF4LWhpdC13aXRoLWN5YmVyYXR0YWNrLXRheC1yZXR1cm5zLWNvbXByb21pc2VkL2QvZC1pZC8xMzMzOTU0IiwidG9wV2luZG93TG9jYXRpb25MZW5ndGgiOjExNiwibmFtZSI6ImVudmlyb25tZW50SW5mbyJ9LHsic2Vzc2lvbklkIjoiczE1NTExMjk5MDJ4MTQ2YmQxYTU2Y2VjYzd4Mzk1NzI3NzUiLCJhY2NvdW50SWQiOiI0NGI3NGIzNSIsInN0cmVhbSI6ImFkRXZlbnRzIiwiaW5zdGFudGlhdGlvbiI6IjY0MDIzNjIzMzc1MzMzMjUiLCJpbmRleCI6MiwiY2xpZW50VGltZXN0YW1wIjoxNTUxMTI5OTAzLjc4NiwibmFtZSI6ImNyZWF0aXZlTG9hZGVkIiwidmlld2FiaWxpdHkwME1lYXN1cmFibGUiOnRydWUsInZpZXdhYmlsaXR5NTAxTWVhc3VyYWJsZSI6dHJ1ZSwidmlld2FibGVUaW1lTWVhc3VyYWJsZSI6dHJ1ZSwiY2RuVmFyaWFudCI6Im5vbmUifSx7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjMsImNsaWVudFRpbWVzdGFtcCI6MTU1MTEyOTkwMy44MDQsIm5hbWUiOiJ2aWV3cG9ydFBsYWNlbWVudEdlb21ldHJ5IiwicGFnZURpbWVuc2lvbnMiOnsiaGVpZ2h0Ijo2NzAyLCJ3aWR0aCI6MTU4NX0sInZpZXdwb3J0UG9zaXRpb25SZWN0Ijp7IndpZHRoIjoxNjAwLCJoZWlnaHQiOjEyMDAsImxlZnQiOjAsInRvcCI6MH0sImZpcnN0UGxhY2VtZW50UG9zaXRpb25SZWN0Ijp7ImxlZnQiOjkzNC41LCJ0b3AiOjQzMi45MjE4NzUsIndpZHRoIjozMzYsImhlaWdodCI6NjAwfX0seyJzZXNzaW9uSWQiOiJzMTU1MTEyOTkwMngxNDZiZDFhNTZjZWNjN3gzOTU3Mjc3NSIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiNjQwMjM2MjMzNzUzMzMyNSIsImluZGV4Ijo0LCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MDMuODA1LCJuYW1lIjoidmlld2FibGUwMCIsImNyaXRlcmlvbiI6eyJuYW1lIjoiQ29yZSIsInJhdGlvIjowLCJ0aW1lIjowfX0seyJzZXNzaW9uSWQiOiJzMTU1MTEyOTkwMngxNDZiZDFhNTZjZWNjN3gzOTU3Mjc3NSIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiNjQwMjM2MjMzNzUzMzMyNSIsImluZGV4Ijo1LCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MDMuODE5LCJ1bml0TmFtZSI6ImJhbm5lciIsInVuaXRWYXJpYW50TG9jYWxJZCI6bnVsbCwic2NyZWVuTG9jYWxJZCI6MTM2OCwic2NyZWVuVGl0bGUiOiJSZXNvdXJjZXMiLCJzY3JlZW5Jc01hc3RlciI6ZmFsc2UsIm9iamVjdExvY2FsSWQiOm51bGwsIm9iamVjdE5hbWUiOm51bGwsIm9iamVjdENsYXp6IjpudWxsLCJpbml0aWF0aW9uVGltZXN0YW1wIjoxNTUxMTI5OTAzLjgxOSwibmFtZSI6InNjcmVlblNob3duIn0seyJzZXNzaW9uSWQiOiJzMTU1MTEyOTkwMngxNDZiZDFhNTZjZWNjN3gzOTU3Mjc3NSIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiNjQwMjM2MjMzNzUzMzMyNSIsImluZGV4Ijo2LCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MDMuODE5LCJuYW1lIjoiY3JlYXRpdmVSZW5kZXJlZCJ9XX0=?crc32c=3659885269
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.11.67 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-209-11-67.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:03 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 player_api Show response
www.youtube.com/ Frame 9CBB 859 B
1 KB 39ms
25ms Script
application/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/player_api

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:808::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

75312b52055e7a65b0d35173f6ed4804eb23ccc8d0a6287c4db262fcece145b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:03 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 859
x-xss-protection: 1; mode=block
expires: Tue, 27 Apr 1971 19:44:06 EST

GET
H2 200 user_timeline Show response
cache-ssl.celtra.com/api/twitter/statuses/ Frame 9CBB 56 KB
5 KB 386ms
385ms Script
application/javascript 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cache-ssl.celtra.com/api/twitter/statuses/user_timeline?screen_name=alienvault&jsonp=jsonp_celtra_twitter_proxy_366
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 161cb0d2dc1f3617582f062cd56fc78ba5678eacdf46a115a8a1f144a4c36ee3

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:04 GMT
content-encoding: gzip
age: 0
x-cache: Miss from cloudfront
status: 200
content-length: 4411
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
server: Apache
etag: "3954a7756c5b1f08260798b1ef03227f9543328e300116704e1c1f2f93206a57"
vary: Accept-Encoding
x-varnish: 41783760
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=900
access-control-allow-credentials: false
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: mBy27n99Vcb3aZeHzHkA4hWWH_G4qZnxrSFMGCGLjSFIUkwhYlFjlg==

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 146ms
104ms Image
image/gif 54.209.11.67
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjcsImNsaWVudFRpbWVzdGFtcCI6MTU1MTEyOTkwMy44MjksIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNTUxMTI5OTAzLjgwNiwidG8iOjE1NTExMjk5MDMuODA2fV19?crc32c=3082050281
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.11.67 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-209-11-67.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:03 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vflN2g023/ Frame 9CBB 20 KB
8 KB 34ms
6ms Script
text/javascript 2a00:1450:4001:817::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vflN2g023/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/player_api

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d6d1f0f7c29c75c0bf3f35fdb95ef16b1ca016bce397885dcb56c6c8c0b8367f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 18:44:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9614
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
content-length: 7738
x-xss-protection: 1; mode=block
last-modified: Sat, 23 Feb 2019 21:30:08 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Tue, 05 Mar 2019 18:44:49 GMT

GET
H2 200 f555353a83d1fba4fb4052b8bf34f535b0ccb534f551690ac87cb62fdf18221f
cache-ssl.celtra.com/api/videoThumb/ Frame 9CBB 41 KB
41 KB 63ms
21ms Image
image/jpeg 54.230.202.81
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/videoThumb/f555353a83d1fba4fb4052b8bf34f535b0ccb534f551690ac87cb62fdf18221f?transform=thumbnail&width=null&height=300&position=50
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.81 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-81.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 95341db5841a92b28b94da509bda7f7acc8209b67870b20050cf6618e9e13f56

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com

Response headers

date: Thu, 31 Jan 2019 09:00:50 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 d89eaba973a5c1614ea9f0994f5e8a12.cloudfront.net (CloudFront)
age: 2204651
x-cache: Hit from cloudfront
status: 200
content-length: 41731
server: Apache
etag: "95341db5841a92b28b94da509bda7f7acc8209b67870b20050cf6618e9e13f56"
x-varnish: 6553767 2293869
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: aBlg7Tz7k_wCo2s6KyEGsnxHk9bZn4daFLE56eOr2UperCtVlHgapg==

GET
H2 200 down.png
cache-ssl.celtra.com/api/blobs/eaafd511c2d263ab1961980b26dc7721796db2b86b87b88c652f0f5eb5445ce7/ Frame 9CBB 896 B
1 KB 22ms
21ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/eaafd511c2d263ab1961980b26dc7721796db2b86b87b88c652f0f5eb5445ce7/down.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: 86a6f0a67dc0caabe1a210beafa2c5722d1d0d54eaba74bd8ec9d864d6f10dd4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 14 Jan 2019 20:39:12 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 3631551
x-cache: Hit from cloudfront
status: 200
content-length: 896
server: Apache
etag: "86a6f0a67dc0caabe1a210beafa2c5722d1d0d54eaba74bd8ec9d864d6f10dd4"
x-varnish: 3427465 12717177
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: NNrJLWEF3DJjkYJRgG1l-GM_8vyw8iSWMhA92X62U6_s3TxA5uZ5uA==

GET
H2 200 up.png
cache-ssl.celtra.com/api/blobs/8585b47c9a815275d8896e45bd205117adff26c8e6df74942df763d6e5a56c90/ Frame 9CBB 906 B
1 KB 9ms
8ms Image
image/png 54.230.202.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/8585b47c9a815275d8896e45bd205117adff26c8e6df74942df763d6e5a56c90/up.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.118 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-118.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: f6cead322117a6afa6e2941b60bb20329d60593358515ae18c727a02c9786633

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 14 Jan 2019 21:02:24 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
age: 3630158
x-cache: Hit from cloudfront
status: 200
content-length: 906
server: Apache
etag: "f6cead322117a6afa6e2941b60bb20329d60593358515ae18c727a02c9786633"
x-varnish: 6266407 2375842
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 4BmoLAFxdCPnFRlFKpwLxKO3CcVjC7Dpoql2vyz4SPtQrLdTpfziQA==

GET
H2 200 f253032d81044de1bf233d35708667f9797d2b99c95b5508656621ac3e0ff289
cache-ssl.celtra.com/api/videoThumb/ Frame 9CBB 22 KB
23 KB 55ms
15ms Image
image/jpeg 54.230.202.81
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/videoThumb/f253032d81044de1bf233d35708667f9797d2b99c95b5508656621ac3e0ff289?transform=thumbnail&width=null&height=300&position=50
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.202.81 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-202-81.fra50.r.cloudfront.net
Software: Apache /
Resource Hash: d274ec80bf3bc9a283743e7565818cc381fb7d313274bb359210138ee4a22e33

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Origin: https://www.darkreading.com

Response headers

date: Mon, 28 Jan 2019 07:45:19 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 d89eaba973a5c1614ea9f0994f5e8a12.cloudfront.net (CloudFront)
age: 2468383
x-cache: Hit from cloudfront
status: 200
content-length: 22764
server: Apache
etag: "d274ec80bf3bc9a283743e7565818cc381fb7d313274bb359210138ee4a22e33"
x-varnish: 25395641
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: dphP6f4wU6qv2DN5F37KswWTXElOfOAmZMKLvIL4Co2mT3dklL-d5w==

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C646 42 B
110 B 15ms
14ms Image
image/gif 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFJupcyM58N92RdhTTae3aDxxJG1flhPU_t6HbOD5qATI-1sNZMhZonCPNCUzkf3LZtOIPBEbUOD7z3HEZX4ZwMgT4vES_5_VI1vE&sig=Cg0ArKJSzG74tUY7odRlEAE&adk=1970779331&tt=-1&bs=1585%2C1200&mtos=758,758,1065,1065,1065&tos=758,0,307,0,0&p=1053,953,1303,1253&mcvt=1065&rs=3&ht=0&tfs=752&tls=1817&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1551129902508&rpt=474&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C1526&ss=1600%2C1200&pt=-1&deb=1-3-8-15-16-29-122-14&tvt=1795&r=v&id=osdim&uc=13&upc=11&tgt=DIV&cl=1&lop=1&tslp=1060&cec=1&clc=1&cac=0&cd=300x250&v=20190220

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:04 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C646 42 B
110 B 15ms
15ms Image
image/gif 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssMV8T6AdQk0kA0wdRx-BZrjQmzY3PfrgVUi_uVO33TTVRmxbooL1wSMjjJhvuSMVc8opVXJ1Ueq6lNrl35&sig=Cg0ArKJSzFwcE2UUljJcEAE&adk=1970779331&tt=-1&bs=1585%2C1200&mtos=758,758,1065,1065,1065&tos=758,0,307,0,0&p=1053,953,1303,1253&mcvt=1065&rs=3&ht=0&tfs=752&tls=1817&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1551129902508&rpt=474&isd=0&msd=0&lm=2&oseid=3&xdi=0&ps=1585%2C1526&ss=1600%2C1200&pt=-1&deb=1-3-8-15-16-29-122-14&tvt=1795&r=v&id=osdim&uc=13&upc=11&tgt=DIV&cl=1&lop=1&tslp=1060&cec=1&clc=1&cac=0&cd=300x250&v=20190220

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Feb 2019 21:25:04 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 U1x4jo79_normal.jpg
pbs.twimg.com/profile_images/710277174180184065/ Frame 9CBB 2 KB
2 KB 7ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/710277174180184065/U1x4jo79_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4191) /

Resource Hash

6881dba9204410b5151e4521f93d928524738297f8bf0fdc0a6af1ccab40ef72

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 25 Feb 2019 21:25:04 GMT
x-content-type-options: nosniff
content-md5: aHI+65tQNzdlgY/d+V29Hg==
x-cache: HIT
status: 200
content-length: 1959
x-response-time: 136
surrogate-key: profile_images profile_images/bucket/7 profile_images/710277174180184065
last-modified: Thu, 17 Mar 2016 01:28:49 GMT
server: ECS (fcn/4191)
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 75c8d33c4dd51db4919288de3afc68cc
accept-ranges: bytes

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 32 KB
11 KB 115ms
38ms Script
text/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id: ea1u3hYQrubY64bATByV7XbdUEwnubrR
Content-Encoding: gzip
x-amz-request-id: C7A4752260620705
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Mon, 25 Feb 2019 21:25:04 GMT
Connection: keep-alive
Content-Length: 10245
x-amz-id-2: K18RlJUfOcLGqPBweOGxlnRwDlXGf3sJ9xmH9VYEl/y0PkuDogldNb5vLb+8XwpkMDwvGhsO3bE=
Last-Modified: Wed, 20 Feb 2019 19:22:50 GMT
Server: AmazonS3
ETag: "a75c16aa500b21e32e06699919372ec4"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK TQSV74R4GVCSJITSZC2MCP Show response
d.adroll.com/consent/check/ 40 B
200 B 151ms
33ms Script
application/javascript 46.51.186.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP?_s=ac35295a95a14a2383ab37ee14e8893c
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.51.186.75 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-46-51-186-75.eu-west-1.compute.amazonaws.com
Software: nginx/1.14.1 /
Resource Hash: 6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:04 GMT
Server: nginx/1.14.1
Connection: keep-alive
Content-Length: 40
Content-Type: application/javascript

GET
H/1.1

200
OK

jot.html
platform.twitter.com/ Frame 7D53
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

0
0

8ms
7ms

Document
text/html

2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40D6) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Feb 2019 21:25:04 GMT
Etag: "d9592a6c704736fa4da218d4357976dd"
Last-Modified: Mon, 25 Feb 2019 17:42:52 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40D6)
X-Cache: HIT
Content-Length: 80

Redirect headers

status: 302 302 Found
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
content-type: text/html;charset=utf-8
date: Mon, 25 Feb 2019 21:25:04 GMT
expires: Tue, 31 Mar 1981 05:00:00 GMT
last-modified: Mon, 25 Feb 2019 21:25:04 GMT
location: https://platform.twitter.com/jot.html
pragma: no-cache
server: tsa_f
strict-transport-security: max-age=631138519
x-connection-hash: 25b904559beb1a13ed570fb24e74f8f1
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 125
x-transaction: 0067d99200ec6eff
x-tsa-request-body-time: 20
x-twitter-response-tags: BouncerCompliant
x-xss-protection: 0

GET
H/1.1 200
OK consent.js Show response
s.adroll.com/j/ 67 KB
68 KB 40ms
39ms Script
application/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id: yvF3y5OARyGYjZyuW4BqgiCbPvLhhPrH
x-amz-request-id: 7EBD99F69567301D
x-amz-server-side-encryption: AES256
Date: Mon, 25 Feb 2019 21:25:04 GMT
Connection: keep-alive
Content-Length: 68722
x-amz-id-2: ZAMLcakp6pamVvhjTbjoBOeKm/lFBqsh3HyHLH8XDul6YO1D/T5bOMFfxhZ5XZIR3NTSb8PhK6U=
Last-Modified: Thu, 06 Dec 2018 16:37:43 GMT
Server: AmazonS3
ETag: "53cd26585ff224c6851303016ec98536"
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK hod
d.adroll.com/consent/ 42 B
264 B 33ms
32ms Image
image/gif 46.51.186.75
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/consent/hod?_e=view_banner&_s=ac35295a95a14a2383ab37ee14e8893c&_b=626d9f6089ce68&_a=TQSV74R4GVCSJITSZC2MCP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.51.186.75 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-46-51-186-75.eu-west-1.compute.amazonaws.com
Software: nginx/1.14.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 25 Feb 2019 21:25:04 GMT
Cache-Control: no-transform,public,max-age=300,s-maxage=900
Server: nginx/1.14.1
Connection: keep-alive
Content-Length: 42
Vary: Cookie
Content-Type: image/gif

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 105ms
104ms Image
image/gif 54.209.11.67
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjgsImNsaWVudFRpbWVzdGFtcCI6MTU1MTEyOTkwNC44MjIsIm5hbWUiOiJ2aWV3YWJsZTUwMSIsImNyaXRlcmlvbiI6eyJuYW1lIjoiNTAvMSIsInJhdGlvIjowLjUsInRpbWUiOjEwMDB9fV19?crc32c=1406208444
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.11.67 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-209-11-67.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:04 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 109ms
109ms Image
image/gif 54.174.196.40
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjksImNsaWVudFRpbWVzdGFtcCI6MTU1MTEyOTkwNC44NDIsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNTUxMTI5OTAzLjgwNiwidG8iOjE1NTExMjk5MDQuODN9XX0=?crc32c=624736551
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.174.196.40 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-174-196-40.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:04 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 109ms
108ms Image
image/gif 54.174.196.40
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjEwLCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MDUuODU5LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU1MTEyOTkwNC44MywidG8iOjE1NTExMjk5MDUuODQzfV19?crc32c=3985107220
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.174.196.40 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-174-196-40.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:05 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 110ms
109ms Image
image/gif 54.174.196.40
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjExLCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MDYuODc2LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU1MTEyOTkwNS44NDMsInRvIjoxNTUxMTI5OTA2Ljg1OX1dfQ==?crc32c=1221150377
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.174.196.40 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-174-196-40.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:06 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 109ms
108ms Image
image/gif 54.174.196.40
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjEyLCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MDguODkxLCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU1MTEyOTkwNi44NTksInRvIjoxNTUxMTI5OTA4Ljg3Nn1dfQ==?crc32c=2374623004
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.174.196.40 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-174-196-40.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 109ms
109ms Image
image/gif 54.174.196.40
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjEzLCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MTAuOTA4LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU1MTEyOTkwOC44NzYsInRvIjoxNTUxMTI5OTEwLjg5MX1dfQ==?crc32c=3317416358
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.174.196.40 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-174-196-40.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:10 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 110ms
109ms Image
image/gif 54.174.196.40
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTUxMTI5OTAyeDE0NmJkMWE1NmNlY2M3eDM5NTcyNzc1IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiI2NDAyMzYyMzM3NTMzMzI1IiwiaW5kZXgiOjE0LCJjbGllbnRUaW1lc3RhbXAiOjE1NTExMjk5MTIuOTI0LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU1MTEyOTkxMC44OTEsInRvIjoxNTUxMTI5OTEyLjkwOH1dfQ==?crc32c=169292035
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.174.196.40 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-174-196-40.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/threat-intelligence/turbotax-hit-with-cyberattack-tax-returns-compromised/d/d-id/1333954
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Feb 2019 21:25:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Verdicts & Comments Add Verdict or Comment

441 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.teads.tv/	1970-01-18 22:53:36	Name: tt_neustar Value:
.teads.tv/	1970-01-18 22:53:36	Name: tt_liveramp Value:
.teads.tv/	1970-01-18 22:53:36	Name: tt_emetriq Value:
.teads.tv/	1970-01-19 07:37:45	Name: tt_viewer Value: d6e0358d-3fea-4dac-88e2-9f7148a559e2
ng.techweb.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: B3AB182FEAE432488B707203CBC359E4
.demdex.net/	1970-01-19 03:11:21	Name: demdex Value: 89066330347655179410626699228815988173
.darkreading.com/	1970-01-18 22:52:11	Name: undefined_s Value: First%20Visit
.darkreading.com/	1970-01-19 07:37:45	Name: __cfduid Value: d4d11a8914d4aac10aed5f965af00a7861551129901
.darkreading.com/	1970-01-18 22:56:38	Name: s_vnum Value: 1551398400844%26vn%3D1
.darkreading.com/	1970-01-19 16:23:21	Name: __utma Value: 199458747.1412618063.1551129902.1551129902.1551129902.1
.darkreading.com/	1970-01-18 22:52:11	Name: __utmb Value: 199458747.1.10.1551129902
.darkreading.com/	1969-12-31 23:59:59	Name: s_cc Value: true
www.darkreading.com/	1969-12-31 23:59:59	Name: piddlNGPageReferer Value: /
.darkreading.com/	1970-01-18 23:35:21	Name: s_nr Value: 1551129902841-New
.darkreading.com/	1970-01-18 22:52:11	Name: s_invisit Value: true
.darkreading.com/	1970-01-18 22:52:10	Name: __utmt Value: 1
.teads.tv/	1970-01-18 22:53:36	Name: tt_exelate Value:
.darkreading.com/	1969-12-31 23:59:59	Name: __utmc Value: 199458747
.darkreading.com/	1970-01-19 16:24:48	Name: AMCV_77FB1CFE532B22840A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C17953%7CMCMID%7C84603908909848643900450804844601125694%7CMCAAMLH-1551734701%7C6%7CMCAAMB-1551734701%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1551137101s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-17960%7CvVersion%7C3.1.2
.teads.tv/	1970-01-18 22:53:36	Name: tt_bluekai Value:
.darkreading.com/	1970-01-19 03:14:57	Name: __utmz Value: 199458747.1551129902.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
www.darkreading.com/	1970-01-24 10:20:56	Name: darkreading%5Fvisits Value: 4
www.darkreading.com/	1969-12-31 23:59:59	Name: piddlNGSiteReferer Value: /
.facebook.com/	1970-01-19 01:01:45	Name: fr Value: 0w89qslfTMAe6T14x..BcdF0u...1.0.BcdF0u.
.darkreading.com/	1970-01-19 16:26:14	Name: mbox Value: session#657696f7d7ad4b2d8520c82cb1d72fb1#1551131762\|PC#657696f7d7ad4b2d8520c82cb1d72fb1.26_18#1614374702
.darkreading.com/	1970-01-19 01:01:45	Name: _fbp Value: fb.1.1551129902223.1704976188
.darkreading.com/	1970-01-19 16:23:21	Name: __gads Value: ID=0b5d3b40086ad706:T=1551129902:S=ALNI_MYOb14o1E27sJ-xut43TWSSy9GCAg
www.darkreading.com/	1970-01-24 10:21:51	Name: darkreading_lastvisit Value: 2/25/2019 4:25:02 PM
www.darkreading.com/	1970-01-18 22:52:37	Name: darkreading%2Dmeter Value: 1333954
www.darkreading.com/	1969-12-31 23:59:59	Name: cplChannelTagID Value:
.darkreading.com/	1969-12-31 23:59:59	Name: check Value: true
.darkreading.com/	1969-12-31 23:59:59	Name: AMCVS_77FB1CFE532B22840A490D45%40AdobeOrg Value: 1

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js(Line 546) Message: Powered by AMP ⚡ HTML – Version 1902081532110
console-api	error	URL: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js(Line 138) Message: localStorage not supported.
console-api	info	URL: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js(Line 546) Message: Powered by AMP ⚡ HTML – Version 1902081532110
console-api	error	URL: https://cdn.ampproject.org/rtv/011902081532110/amp4ads-v0.js(Line 138) Message: localStorage not supported.
console-api	info	URL: https://platform.twitter.com/widgets.js(Line 1) Message: You may have been affected by an update to settings in embedded timelines. See https://twittercommunity.com/t/deprecating-widget-settings/102295.
console-api	log	URL: https://twimgs.com/nojitter/js/dev_adBlockerTrack.js?v1(Line 47) Message: 15
console-api	log	URL: https://twimgs.com/nojitter/js/dev_adBlockerTrack.js?v1(Line 49) Message: false

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.teads.tv
ad.doubleclick.net
ads.celtra.com
adservice.google.de
amp-error-reporting.appspot.com
api-cache.adsnative.com
bat.bing.com
cache-ssl.celtra.com
cdn.ampproject.org
cdn.flipboard.com
cdn.syndication.twimg.com
cf-images.us-east-1.prod.boltdns.net
cm.everesttech.net
cmp.teads.mgr.consensu.org
connect.facebook.net
d.adroll.com
dpm.demdex.net
dsimg.ubm-us.net
epromos.ubmcanon.com
fonts.googleapis.com
fonts.gstatic.com
fpn.flipboard.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
i.ubm-us.net
img.deusm.com
img.en25.com
img.lightreading.com
ng.techweb.com
pagead2.googlesyndication.com
pbs.twimg.com
platform.linkedin.com
platform.twitter.com
rudy.adsnative.com
s.adroll.com
s.ytimg.com
s0.2mdn.net
s2150.t.eloqua.com
s657486201.t.eloqua.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
ssl.google-analytics.com
static.adsnative.com
staticxx.facebook.com
sync.teads.tv
syndication.twitter.com
t.cwkuki.com
t.teads.tv
ton.twimg.com
tpc.googlesyndication.com
track.celtra.com
twimgs.com
u.heatmap.it
ubm.demdex.net
ubm.tt.omtrdc.net
ubmtech.d3.sc.omtrdc.net
www.darkreading.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
www.youtube.com
104.244.42.200
142.0.160.13
151.101.120.159
151.139.239.5
172.217.16.134
172.217.18.2
172.217.22.66
172.82.228.18
184.31.90.134
2.18.232.7
2.18.233.40
204.79.197.200
209.167.231.17
216.58.205.226
23.111.11.217
23.45.99.242
2600:9000:200d:f800:14:85db:2b40:93a1
2600:9000:200d:fc00:e:5a70:ca47:86e1
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2606:2800:234:b6ab:6556:9a85:ba61:ee81
2606:4700:20::6818:452
2606:4700:30::6818:7975
2606:4700:30::681b:8a16
2606:4700:30::681f:5172
2606:4700::6811:7863
2606:4700::6813:f408
2620:103::192:155:48:119
2a00:1450:4001:808::200e
2a00:1450:4001:80b::2001
2a00:1450:4001:814::2004
2a00:1450:4001:815::2003
2a00:1450:4001:816::2014
2a00:1450:4001:817::200e
2a00:1450:4001:819::2002
2a00:1450:4001:81a::2002
2a00:1450:4001:81a::2003
2a00:1450:4001:81a::200a
2a00:1450:4001:81b::2001
2a00:1450:4001:820::2002
2a00:1450:4001:820::2003
2a00:1450:4001:821::2002
2a00:1450:4001:825::2006
2a00:1450:4001:825::2008
2a02:26f0:6c00:292::2c92
2a03:2880:f029:16:face:b00c:0:3
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.122.87.50
34.241.198.89
46.105.202.39
46.51.186.75
52.49.47.75
54.146.200.135
54.174.196.40
54.209.11.67
54.230.202.118
54.230.202.81
54.230.202.82
54.230.203.131
66.117.28.86
66.117.29.6
005fb0400987f0ec2ca49cfde00047805aad0941c8f2b760ae756587bae636c6
04f784c83e6dde0588704c7fcc52d62e657f5b09012bb62a1d309d3adc774306
0615fb751c4db849533b1e432f05428e307591466902876f8ab30d7873b7f38b
0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92
0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a
0e07e3d6ad76ab0709eadac430a14cb29751ba0a7bd2dc680bda12f1df02779e
0f9a2285a8ec601a41f5516c284c12b7675d574ef9ac56d6e3bf8a5c1d16bdec
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
132e19a7feb870e59a7fd2266b90a0229d4c0f98479999303f1a5c6a2d13120f
156236d9d1f60fb19a32bac3a9457986d914908f816409d578fb77a6eca67b41
161cb0d2dc1f3617582f062cd56fc78ba5678eacdf46a115a8a1f144a4c36ee3
1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e
1e97210e22581e4b07521a644b8874bf38e72bf51fb77691c4394aecbac3081b
1f21fc94fd58412a90cffa2d2d6ae231fafaf006224654a03fe307eddd379bbb
22c53eeed2c33c21657590793b89fed83648ee555686c0e9ff90b39c1dab406f
2466b97bcdbd9ad0e026385c5767a433425243f95012cedb1712925dfe91dcb4
24a8343066dfb01873c3c3d480f98a6e7268555082c333d468efb1d4304c74db
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
251eca9d8b079a508f490c14cb016033509a966a23720bb032bdfef8dbaae0df
25b438de3e944547e69c6de98e403f46a9aa4fb98e6d1bb34954fd30ebc19b56
2769bd1775af61d81be3732ae80c7a8f1ad4dccd236edf54bbbcb46086d8b76f
2eeb22c5a235ff40df2bc4dd3487d90a6a97a889d066197ae6fcc10614d0c544
2f592d2932eca5d8e07ff899a71dafd9221f11b6ec58878f856e382cc3e25630
3058a687ad12f7b6a114d539329baf8195b96bd93dfc6b3a942d1012c4dfd5aa
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96
31691334cc2c62188e648564568ffcf3fc602e2153073672f92e1b2afc96f242
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
36f685cfc0442417fc1d2999027ff92d51a68a1ebfdc75d56141b72c3d06dda4
37d7c37cc8dfd40699be2ce320562c04d56058103bbc6f638f956e57045ac176
3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e
3b7ee503be8fb5865ba9cf4278326dc3ac1aed1e2ccaa5cc48f4894c6f692483
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407
3e51950a6b89f8f96238b48f66fc0010c55fecd7ef2e3d99aed16201320cbb1f
3f425dd0b2d02d28484158627724fd7f108100abed86656ae430d3f820f3068c
42eb48be2f9f6fc91fcda10af9802cb6aa0733e2dd007c224570ae6ece3dac33
44fc0a3d10c47ae5aa6c77c76b4b8f81aa08022ca464ef235005ddd86570eb5b
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
4587735e3d5dc5ef5149eae835aeb69f971575da9d4a293d9bffbb1dc25afa6b
45e31bcb4f072d9f442333ad139c3085bcf881955711d866035342f3028f4558
46b2c6207ab97c409fe0e2713f0d83551beb7f71a827ccd96a1efea231b08874
478b3ea929d6794cd9f4bf4af9b0f959de871b7ee74c20b0b2027191fdcb5903
48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a
4901c9453014d8e210b2f62189f68c2d7964543517e1fc8447924de7d542058a
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089
4a6857f46af89d2160c950fdacccafa7d00bec93f38c90779708dc0c0625d3ed
4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67
4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b
4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e
508a5b4d4a7cbc7e71d9d1760f8c8a00bcf1c7e3eb2f40b3ca0cf9c81b507ce6
523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b
54f11fd621e5939eb06040298235228ebe3c089d22ecaddc65ed877d1a977c1f
5580503887258e90db4ce59e8a65c69e07b63a92ec91286b9fd29bc3dd0be4c6
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57acef388a037b38756fdd178f355217378fa2a6a9a92d0bd9655e48a9b811cd
57d21c6f607b5795c6ec757ea402750f20a88fe9d00d10287a9f22773b19a082
5a0e9c35f254c2b12c6f2e793d49bf238bff062822d5b25d9029fb3e6d1fc9fd
5bea0ee3455f7e60ae32de7cda7dfd5dba2847dc80cf11818e55babcd35e361a
5de077b4b085d52fb6fa31cdf6060de53ab3766be16023b5bb094a2ef609cd2c
60b7702c7807c624050bc1fbc934d82a87dba7153b23009c56f78fd41545f97a
60f84e180d9241f98dfaac54fc319fff8be52a2977f9959b564d842ee8bc04c6
61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b
63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578
65cf02310277c7d6871993c0ed709b5ad99288848f65a965c01e81b4fe1c016f
67a054e708073422b942a6b638b1d4dd570529b471493954126e705e59fa1219
6881dba9204410b5151e4521f93d928524738297f8bf0fdc0a6af1ccab40ef72
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
6bb981959d783d83df88b9aa48738948c9a8a22c1a31b8cb5305d3e338ebf9a7
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580
6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677
6f15e73a7ab391b586b6f91cc44e85f9263a80183c33a082b42dc018c71a0635
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4
70bd52e90af60aab21171ffa262d2577d8d4064f8a4d55c1c51b6f73ff7bcc94
71867e5ae2dd96b5297383af1bef41ec9e75804f98bf72a672f7a45c59aa8987
75312b52055e7a65b0d35173f6ed4804eb23ccc8d0a6287c4db262fcece145b9
75d29aad4bddee7c54763e562f7472d818cf09f4b86c6be0dd29a404f39c37a6
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
797a731a28322d2665ebbdf42c620f18b1fa51d5637431ffbc3360a16c5c53c1
7a57d28c747283d4ae4de161293b88b1e46949a51768f9abe0e0934e8c321130
7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e
7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862
7b6908c1ddefad4b526966ba3f51d6e03f1f40747b658fbe64b9e3471ce6faf8
7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9
7bfeae359d7815e91aee4eaa70e8b803b785c2b9ef4fbbda9eca1311274126d4
7cbb0e141a91d2c3c30c06148c1a32c2437ea6452f107a4e1fb0c032708a1295
7e92cb972a0c5c33a960ba9135f7542284b23c9e51fba36b3ae77dd170fd65c5
825dd78f9b83e39cd64cd3345c7d020aa9b7cfd796e43f942bacc4b5bd3ee43f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985
86a6f0a67dc0caabe1a210beafa2c5722d1d0d54eaba74bd8ec9d864d6f10dd4
87cdbacb358e421a482bc1a52dc9cfc04a9f6d8dfe86c7c6c66bcde013792850
88c9040505b21909fd8023a7d95fb0d2d404e8e14c38dc198325c40835674315
88f6b155f6df559c17b78785558ec29de6429ef62232a26ad2ddbf8f8de07209
89116cf4f75bcb8ec9fc6730044fb39ec40f795b19d8a57992c5ce8c5a52c227
8adb798247b01b0a69cb89ba9938dd4560123aa78dc1a983f3904fba8d9484ae
8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28
8d8f7d2468648e6c710f7de999803dfe164b5364ac9ed75a0f4f44c82654d144
8e7ad8de87781f6ad65b36a7d3243b44d80dc182df6af076484a2bec85051550
902118c5436b3d46d79f44c3f8e7012eb9acc9b4b341e034e7bf0259aca4b425
9182e8a1e20a5437d2f311b096b2a98a33d54e94d4d9d6d01c5db3861460d04e
924b3a471d549de6251aea0e74fe6eb136141d3f0a8bf001906fff933dec45d4
9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39
95341db5841a92b28b94da509bda7f7acc8209b67870b20050cf6618e9e13f56
966442844b9cf867a9c6d558ea60481788c4b050730a29a87b7139668fed26e4
976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875
984cd1fa5dd20c2b1b8fd77b6bb876a3a211cdf14aaaed6bc1481e3c98027544
9860a8d4dad7b5dcc531c5ec839274a273a05786ad6b74d08d8199259bfa4509
98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4
99fda2c1633832ff2aa402fbf04c50e37625d0fce4454865bee84c3a09c9704c
9ac4bc532552c09709c3bb10796a1140954fa07185f5c0890b78ad0c02fcf91a
9af9477e22eabfdb62baa0d660360ca03fa96fbab4d05d63a81935f14dbe2ae8
9b25230c2a3962d55b1535f6f8aa484d04b5d9f9164c0b9b698ab319604ec778
9c03ac026e206115e0583f90338c9dcb06ea48ad5241067a166a1c394f9ee591
9dc3847fd8d296e1570d5b6752b4d9e3044993257b2f0e4bd5cfdedcf61e0f59
9e03d610493a32cfa7a9750ac0c194f807c46926270e565fc8b41ee71053a52d
9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4
9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2d47920b183262726f3833c961cb98c24f65c396bb248c4539391d72553284e
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be
a6facfe55d875891c8b80bba2a1be254333bd22dbc8d21e2da6dfcfe6c1b3f38
a826cda262823b8ca4f27514fdd45cfa283e4bb8e946ee92ebd1caff2c602556
a855b14aa4fa07fff51f4d906b86222879e9720e98ad477057cb3298df36f348
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2
a8fc74838ba253a4076b8eb46aeed79c10341380609dcfe11bed40d974d1fd10
aa92b44ae441805b86a9603ffea3890a8df348fb2269d716c557b6970c11e9f4
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae81a5d01266cf45292b4f2ef1ab047e1dc349beb9ae07e31ab3c73071a0ebb9
b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81
b2457190882f6b0b84e494f8c42d69445c5f914ce41acfa14b1d7f791cd979bb
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287
b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572
b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6
b8681e778e51dd892f7a2f3b13e8de295693faec44a653755456405021494cd1
b90279154254e108748dc80dd226eab336e2c320e4a40569952b46dc5d785536
bb75b1b9309a7b05aa80519903f6e8c6c446fa6e5f7cf5db22ad8753612174ad
bec117b5be8f22e9305be68965e3734a5135357a3ac88cda5814b7069a1c62dc
bec4f2f082be46c47ba8f2398813bb3c90495d69405fa0981506b1fd13ba29d6
bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987
c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794
c1ba095f1ecd3931eaac726c19f603f2bcb7288a8fab26582637297b9c5530a3
c265aee8bf383ed2165be8d4b78103c988e6b70f5bc98ffdbbe89967c57def05
c5a37d18a14fb428d01bfe23b0e28db9b7a189e886513a7098683cb01f0929ee
c5b30ee3fd20ce526f71268280257be44da5e58c606268836dc890ac70706d87
c5cfc527894a919282ef88af933d000c2acd9c82ff1ba41701feed18119e66ee
c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff
c85a0459dea5ca94496b30f7dbd4121bcac56fb77bb48059e3c1906806b33f5c
c94ad448b05002218551938d40e2baf3617a3d56a4455729d84993a5b7b311cf
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cddbf405266cd4b3e66229592e63666012dbceaaad02635af5da9d303bfd3ed1
cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b
cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe
d07f1ea820b5b946f4baf83c9ca81fda8b8f43d3271ae124caf04572352fa806
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c
d274ec80bf3bc9a283743e7565818cc381fb7d313274bb359210138ee4a22e33
d4b95126382745e9e07d76812e3bbc8d6de2cfa6356c586f930ece7d4acb8052
d574aac518d01e853f2df2792c1b202ff69282c704b4e5622dfbcf22a2767879
d58f7e95bf8f6784186de8e32db1ab79e9e3521a17494dfefc8b30e7f4475a73
d6d1f0f7c29c75c0bf3f35fdb95ef16b1ca016bce397885dcb56c6c8c0b8367f
d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745
d752f713e203c62dbc776dd030354ceb8337f0fc7cb07be2b2f905119b177221
d77331211505d7a80759e3ac50c05ea7b26544a4d5e1c74f25ecc9fbc2d99153
d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3
d9053ec3a7a0bdbdcb96173299c0ba89bc15f3134849fff570e37d6322676304
dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f
e005d15369c0b86171223631c22b5c7a037c0a22459fe06cd50aec8cf0e91a76
e14d4e36fede709207c2745214d0d4c29d09f08df902c95997b2da292cf58f8a
e26fdccb214e020f70cf2aede7b77d5dc51854e23b3acbb4bcff0018773a636f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48b5b18cd4fa82b4a90346da0845bf73a3d9f752fa1e173ce141a98fddeaf6f
e4a73b26661f72b70c74a515c07c380f9cd673b037fd0def630c9d6ac8229fce
e7a3bbddb3d813cb973cb639c1104e1cd2525abd97e356a46186d7832e7b0d8c
e7c11470406c01438564eeb2d76119d52470d572f5ae04b39cea9cc4e5ee6022
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10
ecded18536426e30f5af01e39779ff4f66c52fd762ba75729188b80e37f7cfac
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f114c01e65a025ba9b36cecae835b7d85bfaf27100a49d225b27414ca14a0bae
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217
f348aaddd9411de71b51b80b9a2a596f1761af08d36f02f7778aeac1d4009b49
f50167bee40cd7fdd6c623efb794e0edddec7de87ef71f48c8b1b1413e1dfc4a
f5932acd6c5f2796f354dedc5e8dfe30e206787365186bbf0f9789d083472a75
f6cead322117a6afa6e2941b60bb20329d60593358515ae18c727a02c9786633
f95e67a383d9303db5f3d27bb1e8d0a155f881dbd89edf15cda37fba28e67bc1
fafe9e0f27eece0255550c7f9869d07296a726f1cfe7db344aa9205e13b7e719
ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750

www.darkreading.com Open in urlscan Pro 2606:4700::6811:7863 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

248 Requests

97 %HTTPS

52 %IPv6

42 Domains

64 Subdomains

62 IPs

5 Countries

3671 kBTransfer

8243 kBSize

32 Cookies

74 Outgoing links

Redirected requests

248 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.darkreading.com Open in urlscan Pro
2606:4700::6811:7863 Public Scan

Screenshot
Live screenshot

Full Image

248
Requests

97 %
HTTPS

52 %
IPv6

42
Domains

64
Subdomains

62
IPs

5
Countries

3671 kB
Transfer

8243 kB
Size

32
Cookies

248 HTTP transactions
3 data transactions