www.kroll.com Open in urlscan Pro
2606:4700:4400::6812:2b89  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32

• https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
• https://unpkg.com/web-vitals@4.0.0/dist/web-vitals.iife.js

Request Chain 37

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D654419%26time%3D1715671668085%26url%3Dhttps%253A%252F%252Fwww.kroll.com%252Fen%252Finsights%252Fpublications%252Fcyber%252Fcactus-ransomware-prickly-new-variant-evades-detection%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&cookiesTest=true&liSync=true&e_ipv6=AQKfPe2m-Vtj3gAAAY92ABg30j8u-ywuG1saNns41feA9abbwtD_ATv0zgutXr-OHfbjvn8

89 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request cactus-ransomware-prickly-new-variant-evades-detection Show response www.kroll.com/en/insights/publications/cyber/	415 KB 81 KB	1091ms 1057ms	Document text/html	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash d99e6581f6bfc619aa80b8f71565ace2b13083bbf93150578d5ec27b01a27eb3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers CF-Cache-Status DYNAMIC CF-Ray 88392aed084d8f3a-FRA Cache-Control public, s-maxage=10, stale-while-revalidate=59 Connection keep-alive Content-Encoding br Content-Type text/html; charset=utf-8 Date Tue, 14 May 2024 07:27:47 GMT Server cloudflare Strict-Transport-Security max-age=31536000 Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By Next.js request-context appId=cid-v1: x-middleware-rewrite /en/_site_kroll/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-sc-rewrite /_site_kroll/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection
GET H/1.1	200 OK	d35a04353948afe1.css www.kroll.com/_next/static/css/	1 MB 96 KB	205ms 188ms	Stylesheet text/css	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/css/d35a04353948afe1.css Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f89e1c603e606206a2fe7f883c014005a434d2c71d4af1885f708e2af9faa8b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547107 ETag W/"147984-18f19c7a0a7" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af3ec3239ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	e42805f0776a68d8.css www.kroll.com/_next/static/css/	56 KB 16 KB	165ms 148ms	Stylesheet text/css	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/css/e42805f0776a68d8.css Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15a38e578f0088db5a5b4ec7089d28b4b6e2f39943b7fae9e5fe364e5b1bbc0c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:47 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Wed, 03 Jan 2024 13:56:02 GMT Server cloudflare Age 5313349 ETag W/"dfd0-18ccf9c1773" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af3ef5fa06a-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	e2767bd096bfb193.css www.kroll.com/_next/static/css/	18 KB 4 KB	174ms 156ms	Stylesheet text/css	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/css/e2767bd096bfb193.css Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe9eeacc872e2235a6fa9251f2f697439e93d94932edffaec82cb085eefb9087 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:47 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"463b-18f19c7a0b7" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af3e87303ec-FRA request-context appId=cid-v1:
GET H2	200	jquery-3.5.1.min.js Show response code.jquery.com/	87 KB 30 KB	27ms 6ms	Script application/javascript	2a04:4e42::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.min.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:47 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1527840 x-cache HIT, HIT content-length 30879 x-served-by cache-lga21981-LGA, cache-fra-eddf8230071-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1715671668.843433,VS0,VE0 etag W/"28feccc0-15d84" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 9, 452429
GET H/1.1	200 OK	webpack-6b87c4dfd5b4a3b9.js Show response www.kroll.com/_next/static/chunks/	2 KB 1 KB	165ms 164ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/webpack-6b87c4dfd5b4a3b9.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0aaa817ba4763ed01b1cab3f64ad7f8d440d264fdf6de4fa9dad1687d89346d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Sat, 13 Jan 2024 02:40:01 GMT Server cloudflare Age 454400 ETag W/"6c5-18d00b0c51d" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af4e98103ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	framework-9404d76916f8a9f9.js Show response www.kroll.com/_next/static/chunks/	206 KB 59 KB	146ms 146ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/framework-9404d76916f8a9f9.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2cb43fcb2a053b758441c8dac6d1738dd6d9fee19b7530fd7c21a14b7bf21832 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547107 ETag W/"33701-18f19c7a049" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af53d8b39ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	main-bff998b1b6a9dce5.js Show response www.kroll.com/_next/static/chunks/	115 KB 35 KB	166ms 166ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 47bbe04bc037b59eed1c4ed0957263ae563750676dafabe84e68e00b1064472e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547107 ETag W/"1cbf6-18f19c7a049" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af53e3b917c-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	_app-e21adf0388710977.js Show response www.kroll.com/_next/static/chunks/pages/	69 KB 24 KB	167ms 167ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/pages/_app-e21adf0388710977.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 61f417fe13ec2c3f29d06f1471d465c8c523006d58d1ed9851c913f48c157de0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"1159c-18f19c7a078" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af5cb808f3a-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	d6e1aeb5-1790e9f39247cef1.js Show response www.kroll.com/_next/static/chunks/	475 KB 137 KB	145ms 145ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/d6e1aeb5-1790e9f39247cef1.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0bc48279cbc29dcca4892813e55b10c36911d0ceb3422710da4fd717f788271 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"76b1c-18f19c7a049" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af64f74917c-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	b637e9a5-c2a222d187f3c3d1.js Show response www.kroll.com/_next/static/chunks/	85 KB 32 KB	148ms 148ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/b637e9a5-c2a222d187f3c3d1.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e9dddedc7603210ab47959449ab07291a9032faa84a98940207aa2db0ace94a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"152b3-18f19c7a03a" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af6dcac8f3a-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	684-0d837124b1e48847.js Show response www.kroll.com/_next/static/chunks/	1 MB 321 KB	139ms 139ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/684-0d837124b1e48847.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc90a69efeb25968e48ffa17cc0cf6f49bcfc78e7819bd38f20e485f6b83d009 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"1086d8-18f19c7a03a" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af6ebc103ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	507-98c550fcfd143b47.js Show response www.kroll.com/_next/static/chunks/	536 KB 121 KB	171ms 170ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/507-98c550fcfd143b47.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e44201e5b89f0f3d0601c6aedd5174bc1f29749c03196631c7f13982fb623c69 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"85f3d-18f19c7a01b" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af75881917c-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	%5B%5B...path%5D%5D-5ace72b9da22f7cf.js Show response www.kroll.com/_next/static/chunks/pages/	271 B 689 B	140ms 140ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/chunks/pages/%5B%5B...path%5D%5D-5ace72b9da22f7cf.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd345ce034bf4df9393dbd45f7bca4baa19191b3b01073479dd8dd5a6297eb4b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 195317 ETag W/"10f-18f19c7a059" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af75e624dc5-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	_buildManifest.js Show response www.kroll.com/_next/static/uHimoO12Tb73jwnI1B-P_/	2 KB 1 KB	275ms 275ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/uHimoO12Tb73jwnI1B-P_/_buildManifest.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 77c4dbdb26c47064695e77b03333a29ffe5088241693d9743be6e424e5ac2d04 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"835-18f19c7a0c6" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af7cda98f3a-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	_ssgManifest.js Show response www.kroll.com/_next/static/uHimoO12Tb73jwnI1B-P_/	91 B 569 B	156ms 156ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/uHimoO12Tb73jwnI1B-P_/_ssgManifest.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ddeea69d5116852145775870dab4d86b4e909e7a02c03465efaa67d5b0f744be Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"5b-18f19c7a0d6" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af808b639ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	externalbio.png www.kroll.com/	3 KB 3 KB	558ms 540ms	Image image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/externalbio.png Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 20c24bca0778f3690b2d1d68e1331e9ffa44251889c778fd6221feaa0b1d6f45 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status MISS Last-Modified Wed, 03 Jan 2024 13:56:02 GMT Server cloudflare ETag W/"b67-18ccf9c180f" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes CF-Ray 88392af3ea4d4dc5-FRA Content-Length 2919 request-context appId=cid-v1:
GET H/1.1	200 OK	cactus-tactics-techniques-procedures.svg www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	181 KB 19 KB	223ms 204ms	Image image/svg+xml	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/cactus-tactics-techniques-procedures.svg Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe445ee611a9678a4b9c82841bae30ee181f813a4ecb18be680f99a20ad0ef2f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT Content-Encoding br x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 66839 Transfer-Encoding chunked Content-Disposition inline; filename="cactus-tactics-techniques-procedures.svg" Connection keep-alive X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Thu, 11 Jan 2024 10:02:48 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/svg+xml Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) CF-Ray 88392af3fc98917c-FRA
GET H/1.1	200 OK	first-100-bytes-of-700.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	21 KB 22 KB	299ms 156ms	Image image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/first-100-bytes-of-700.png?h=73&w=700&hash=572E1E0D472C3286CE345D9B9E55497C Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ffd3c0fe6811aab425174d6e4d62be49b5862024e65df56cd0ebd0a895b1a978 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 172337 cf-polished origSize=38397 Content-Disposition inline; filename="first-100-bytes-of-700.png" Connection keep-alive Content-Length 21322 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:13:47 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare cf-bgj imgq:85,h2pri ETag ef0d5b21f88c4a6d9305569adb57e943 Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af4ca268f3a-FRA
GET H/1.1	200 OK	data-with-standard-hex-decoding.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	16 KB 17 KB	746ms 746ms	Image image/webp	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/data-with-standard-hex-decoding.png?h=88&w=700&hash=CE121EF62FE10AE74E237657ECB88607 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cbdfb8c54e28070a71577b61669bec83ec169121666914472ea3ba331dc66fe1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status MISS x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Content-Disposition inline; filename="data-with-standard-hex-decoding.webp" Connection keep-alive Content-Length 16452 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:16:37 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare ETag da04f49c1d3f49d68f3c986668112569 Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/webp Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af4d870a06a-FRA
GET H/1.1	200 OK	data-with-hex-decoding.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	19 KB 20 KB	176ms 176ms	Image image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/data-with-hex-decoding.png?h=75&w=700&hash=9ECF8E8A788DFA4CF71A4FDF2C6DA00F Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9930e9e444467501e69dbd05f38db5f8e5e4af1762942bf938f85ef47daaee Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 172332 cf-polished origSize=20032 Content-Disposition inline; filename="data-with-hex-decoding.png" Connection keep-alive Content-Length 19421 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:04:12 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare cf-bgj imgq:85,h2pri ETag 787217efc0ce450fbeaceacf056a086c Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af80cb903ec-FRA
GET H/1.1	200 OK	ransomware-configuration-hidden.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	75 KB 76 KB	666ms 665ms	Image image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/ransomware-configuration-hidden.png?h=169&w=700&hash=882754C85F846AA0725F955E80C804B2 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43edc9f071aa1a711c714060d68d9e3d3f293e8b6af292221b81481ee09ce9ba Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status MISS x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com cf-polished origSize=79429 Content-Disposition inline; filename="ransomware-configuration-hidden.png" Connection keep-alive Content-Length 76470 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:11:11 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare cf-bgj imgq:85,h2pri ETag 3b8778628b8340be896d7d807151efb3 Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af83f444dc5-FRA
GET H2	200	gtm.js Show response www.googletagmanager.com/	579 KB 134 KB	94ms 74ms	Script application/javascript	2a00:1450:4001:82b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PWHXW75 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9efcba416c16a423143edea17e6baf82832abb14bbf3225e6cf300a7e3ebf11a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:47 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 136320 x-xss-protection 0 last-modified Tue, 14 May 2024 06:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 14 May 2024 07:27:47 GMT
GET H2	200	studio-analytics.js Show response static.searchstax.com/studio-js/v3/js/	9 KB 3 KB	75ms 9ms	Script application/javascript	2600:9000:2156:8000:1e:d7b:ca80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.searchstax.com/studio-js/v3/js/studio-analytics.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:8000:1e:d7b:ca80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e273f97d09c191727b7b31e33582f5ae140b698f4f782aac6d6453535e4cb0dd Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 03:38:10 GMT content-encoding gzip via 1.1 a1098f0eeab192209962e3a9d76d0338.cloudfront.net (CloudFront) last-modified Thu, 25 Apr 2024 14:12:38 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 age 13778 x-amz-server-side-encryption AES256 etag W/"591b5f5c717e29909cb75830414e0828" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript x-amz-cf-id hHKS44HA4hlLxa3Nnnmy9kYZZHcgoXNloD0Modv3EZgKmkYyg54BYA==
GET H/1.1	200 OK	hex-string.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	11 KB 12 KB	172ms 172ms	Image image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/hex-string.png?h=35&w=700&hash=AB86E3BAB2CF9613D1C3B9671677A067 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 30040aa4b618b6941b230a4a4633df866041d39aae9ba3816b11158652b137e3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 172330 cf-polished origSize=19835 Content-Disposition inline; filename="hex-string.png" Connection keep-alive Content-Length 11400 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:35:12 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare cf-bgj imgq:85,h2pri ETag 2f37d92194b44686aab762f36b00897e Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af87998917c-FRA
GET H/1.1	200 OK	aes-decryption-of-public-rsa-key.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	14 KB 15 KB	592ms 592ms	Image image/webp	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/aes-decryption-of-public-rsa-key.png?h=408&w=700&hash=41A8095550E70B37463797C0E9286A70 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cb4f42d91ad8a68825b433f60f1b1bc1cbe27ac0edf3597086cd7c4efd4300b7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status MISS x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Content-Disposition inline; filename="aes-decryption-of-public-rsa-key.webp" Connection keep-alive Content-Length 14294 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:26:44 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare ETag 9ac1f44205d04079bb5fb97f664ec307 Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/webp Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af8f9f239ec-FRA
GET H/1.1	200 OK	file-encryption-process.svg www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	57 KB 12 KB	143ms 143ms	Image image/svg+xml	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/file-encryption-process.svg?h=297&w=700&hash=CA96B41C73A55CF58C380ECB74F4A7E2 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4d2f654b768a334c309950f45c5856531a83e5be0aa1104a17bd64510698d6e5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT Content-Encoding br x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 172327 Transfer-Encoding chunked Content-Disposition inline; filename="file-encryption-process.svg" Connection keep-alive X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Wed, 10 May 2023 06:43:59 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/svg+xml Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) CF-Ray 88392af92dd103ec-FRA
GET H/1.1	200 OK	aes-rsa-and-openssl.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	13 KB 15 KB	645ms 645ms	Image image/webp	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/aes-rsa-and-openssl.png?h=460&w=700&hash=B3439304964A1AD5DE7F170D4EB0A738 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 905a055572b80d77466d47cc04b389b81b768c4a2274aed1c63b2e5301b71d11 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status MISS x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Content-Disposition inline; filename="aes-rsa-and-openSSL.webp" Connection keep-alive Content-Length 13774 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:20:35 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare ETag a0a006c5663f41358fd4dc6538e30210 Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/webp Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af98f788f3a-FRA
GET H/1.1	200 OK	cactus-ransom-note.png www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	10 KB 11 KB	141ms 141ms	Image image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/cactus-ransom-note.png?h=103&w=700&hash=670C1563B270FEC708C7D4C603ADBF02 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2253a283c46dee1462781c96c3220adf28410a3ddc96811d67cb532da103740e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 172325 cf-polished origSize=21411 Content-Disposition inline; filename="cactus-ransom-note.png" Connection keep-alive Content-Length 10425 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 May 2023 11:30:39 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare cf-bgj imgq:85,h2pri ETag badc9c3003724137b4679fa6d72b0461 Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392afd6abd03ec-FRA
GET H/1.1	200 OK	binary-execution.svg www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/	299 KB 42 KB	317ms 317ms	Image image/svg+xml	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/media/kroll-images/insights/cactus-ransomware/binary-execution.svg?h=916&w=700&hash=BD9DB6F9AF609E1A1C026324DD642757 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f91bb713b13d7e6425c74957eb4bdc6295502fc305a3fdcd1f4fe4da761b2197 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status MISS Content-Encoding br x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Transfer-Encoding chunked Content-Disposition inline; filename="binary-execution.svg" Connection keep-alive X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Wed, 10 May 2023 06:42:19 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/svg+xml Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) CF-Ray 88392afd8bca8f3a-FRA
GET H/1.1	200 OK	email-decode.min.js Show response www.kroll.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 1 KB	92ms 9ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:47 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Last-Modified Wed, 08 May 2024 09:31:53 GMT Server cloudflare Content-Encoding gzip ETag W/"663b4689-4d7" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript X-Frame-Options DENY Cache-Control max-age=172800, public Connection keep-alive CF-RAY 88392af4ba0f8f3a-FRA Expires Thu, 16 May 2024 07:27:47 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	307 KB 102 KB	42ms 41ms	Script application/javascript	2a00:1450:4001:82b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-S0E5692XKD&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWHXW75 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9cc691ce22174eda6eaffa085d52dc2b1e1de1073e1caedef420474652aac1e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 104100 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 14 May 2024 07:27:48 GMT
GET H2	200	bat.js Show response bat.bing.com/	45 KB 13 KB	66ms 35ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWHXW75 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 14 May 2024 07:27:47 GMT last-modified Thu, 29 Feb 2024 19:58:06 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 097FED4B32974E2F9BA33DBEA982E646 Ref B: FRAEDGE1306 Ref C: 2024-05-14T07:27:48Z etag "01b4e9c496bda1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 13261
GET H2	200	web-vitals.iife.js Show response unpkg.com/web-vitals@4.0.0/dist/ Redirect Chain https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://unpkg.com/web-vitals@4.0.0/dist/web-vitals.iife.js	7 KB 3 KB	20ms 20ms	Script application/javascript	2606:4700::6811:f8cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/web-vitals@4.0.0/dist/web-vitals.iife.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Server 2606:4700::6811:f8cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ca9f20823ffa1266144cc2c6af10f9fe097305ace8fb845dd48ee045e81b235 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.kroll.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Tue, 14 May 2024 07:27:48 GMT content-encoding br via 1.1 fly.io cf-cache-status HIT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 40085 last-modified Sat, 26 Oct 1985 08:15:00 GMT fly-request-id 01HXSSRW3C1EGBHX3E75TJKWSD-fra server cloudflare etag "1be8-Asejo4oSGPcpOI3xecqzNKSnPdQ" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 88392af55be4bbdf-FRA Redirect headers date Tue, 14 May 2024 07:27:48 GMT content-encoding br via 1.1 fly.io cf-cache-status HIT fly-request-id 01HXTZSJCA90E7SVB5VD6PAAXN-fra x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 216 server cloudflare vary Accept, Accept-Encoding content-type text/plain; charset=utf-8 access-control-allow-origin * location /web-vitals@4.0.0/dist/web-vitals.iife.js cache-control public, s-maxage=600, max-age=60 cf-ray 88392af52bbbbbdf-FRA
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	47 KB 17 KB	64ms 15ms	Script application/javascript	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWHXW75 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 06 May 2024 17:20:18 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=53006 accept-ranges bytes content-length 16683
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	218 KB 59 KB	25ms 8ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 14 May 2024 07:27:48 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 57845 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1326, tbw=2808, tp=-1, tpl=-1, uplat=0, ullat=-1 pragma public x-fb-debug QRzeoSkuSXKfCvx2dg9QcqLkpH4DN3Q172USnUILXK1JXnYfNmTnNA3x8Vcw68xChLwRoVFBlhTM4D2FH9PyCg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	pmd7cky.css use.typekit.net/	7 KB 1 KB	180ms 138ms	Stylesheet text/css	2a02:26f0:3500:16::215:149a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/pmd7cky.css Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/css/d35a04353948afe1.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash b48065cfe231510224dc6e19d0b52e5cde12beb63faea02a8f53c9dd3ce64f58 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Tue, 14 May 2024 07:27:48 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 968
GET H2	200	1043474835687043 Show response connect.facebook.net/signals/config/	52 KB 12 KB	68ms 67ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1043474835687043?v=2.9.156&r=stable&domain=www.kroll.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c55dfb01b618cb88641b8cf587ba71a1b0c0eb23c0a6f128cd357f876cd2e98c Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 14 May 2024 07:27:48 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=16, rtx=0, c=64, mss=1326, tbw=63308, tp=-1, tpl=-1, uplat=60, ullat=0 pragma public x-fb-debug yvfvRMBCgSNsR5oLQTD1EODNFjZKGDXaMCQiFY19CTqqU2tZWuK2xCJzx7MaxloP6crGEBWyIiCaF7jLxxQsCw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-de... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-de... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D654419%26time%3D1715671668085%26url%3Dhttps%253A%252F%252Fwww.kroll.com%252Fen%25... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-de... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-d...	0 266 B	315ms 254ms	Image application/javascript	13.107.43.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&cookiesTest=true&liSync=true&e_ipv6=AQKfPe2m-Vtj3gAAAY92ABg30j8u-ywuG1saNns41feA9abbwtD_ATv0zgutXr-OHfbjvn8 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Server 13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.kroll.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers date Tue, 14 May 2024 07:27:48 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: AE6CD9C9ED0645709D9E52C3B2E6390F Ref B: VIEEDGE1609 Ref C: 2024-05-14T07:27:48Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYYZPBjCf4NhWFSKvzaag== Redirect headers date Tue, 14 May 2024 07:27:48 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 40335A22299648D8B66459CBE15042F4 Ref B: FRAEDGE1207 Ref C: 2024-05-14T07:27:48Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=654419&time=1715671668085&url=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&cookiesTest=true&liSync=true&e_ipv6=AQKfPe2m-Vtj3gAAAY92ABg30j8u-ywuG1saNns41feA9abbwtD_ATv0zgutXr-OHfbjvn8 x-li-proto http/2 content-length 0 x-li-uuid AAYYZPBefZ3b+dLVlP/jow==
GET H2	204	56180571.js Show response bat.bing.com/p/action/	0 116 B	32ms 32ms	Script text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56180571.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Tue, 14 May 2024 07:27:47 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: F91F225C84B14BE693F16270821969CE Ref B: FRAEDGE1306 Ref C: 2024-05-14T07:27:48Z x-cache CONFIG_NOCACHE
POST H2	204	collect region1.analytics.google.com/g/	0 253 B	42ms 14ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-S0E5692XKD&gtm=45je45d0v882864807z879996530za200&_p=1715671667819&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1532348893.1715671668&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1715671668&sct=1&seg=0&dl=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&dt=CACTUS%20ransomware%20%7C%20Cyber%20Threat%20Intelligence%20%7C%20Kroll&en=page_view&_fv=1&_nsi=1&_ss=1&ep.tag_name=GA4%20-%20Configuration&ep.gtm_container_and_version_id=GTM-PWHXW75%3B%20Version%20ID%3A%20280&ep.hit_timestamp=2024-05-14%20Time%3A%2009%3A27%3A47.997%20%2B02%3A00&tfd=1425 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-S0E5692XKD&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 14 May 2024 07:27:48 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.kroll.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 244 B	57ms 20ms	Ping text/plain	2a00:1450:400c:c00::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S0E5692XKD&cid=1532348893.1715671668&gtm=45je45d0v882864807z879996530za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-S0E5692XKD&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 14 May 2024 07:27:48 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.kroll.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	33ms 17ms	Image image/gif	142.250.186.35 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S0E5692XKD&cid=1532348893.1715671668&gtm=45je45d0v882864807z879996530za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=1321277933 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.35 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 14 May 2024 07:27:48 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	right-arrow-hover.011d0586.svg www.kroll.com/_next/static/media/	502 B 781 B	174ms 152ms	Image image/svg+xml	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/_next/static/media/right-arrow-hover.011d0586.svg Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/css/e2767bd096bfb193.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2834f9b82c4c204a45b78aa75d5fd38ca0e07df3899a10b0d44e02aa05959c9c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/_next/static/css/e2767bd096bfb193.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547031 ETag W/"1f6-18f19c7a0b7" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/svg+xml Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af5fabe03ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	right-arrow.d22e5af3.svg www.kroll.com/_next/static/media/	485 B 770 B	201ms 150ms	Image image/svg+xml	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/_next/static/media/right-arrow.d22e5af3.svg Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/css/e2767bd096bfb193.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a43925d049aff91c2b5774062181a55ce127ee60db35867c8b7227bf2aab06e5 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/_next/static/css/e2767bd096bfb193.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1546652 ETag W/"1e5-18f19c7a0c6" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/svg+xml Cache-Control public, max-age=31536000, immutable Connection keep-alive CF-Ray 88392af62e8139ec-FRA request-context appId=cid-v1:
GET H2	200	/ www.facebook.com/tr/	0 273 B	28ms 7ms	Image text/plain	2a03:2880:f177:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1043474835687043&ev=PageView&dl=https%3A%2F%2Fwww.kroll.com&rl=&if=false&ts=1715671668158&sw=1600&sh=1200&v=2.9.156&r=stable&ec=0&o=4124&fbp=fb.1.1715671668157.768153712&pm=1&hrl=79867f&ler=empty&cdl=API_unavailable&it=1715671668080&coo=false&cs_cc=1&cas=2294165197339826&rqm=GET Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=6, rtx=0, c=10, mss=1326, tbw=2778, tp=-1, tpl=-1, uplat=0, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Tue, 14 May 2024 07:27:48 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	p.css p.typekit.net/	5 B 172 B	66ms 13ms	Stylesheet text/css	2a02:26f0:3500:16::215:1494 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=pmd7cky&ht=tk&f=28901.40484.40485.40486.40487.40488.40490.40492.40494&a=91935826&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/pmd7cky.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1494 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT last-modified Fri, 23 Jun 2023 17:09:47 GMT server nginx etag "6495d1db-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	l use.typekit.net/af/ff2f63/00000000000000007735b8ff/30/	22 KB 23 KB	107ms 69ms	Font application/font-woff2	2a02:26f0:3500:16::215:149a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/ff2f63/00000000000000007735b8ff/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pmd7cky.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 308a9c476c3561fadda0e17654698bd328ee9f4cd743f6a714a784e217ec0b7b Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pmd7cky.css Origin https://www.kroll.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT server nginx etag "575f27d0430e8d1712e555d32fac51d3e2d0419a" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 22944
GET H2	200	l use.typekit.net/af/42930b/00000000000000007735b8f6/30/	22 KB 22 KB	51ms 13ms	Font application/font-woff2	2a02:26f0:3500:16::215:149a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/42930b/00000000000000007735b8f6/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pmd7cky.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash d15c48611b9c47c0e2f62ccde572a3925911ee9bbbbd47a2f686d294594d07fb Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pmd7cky.css Origin https://www.kroll.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT server nginx etag "eded4f04a82d452a8cbdbd77cbfeb2827dc8164b" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 22596
GET H2	200	l use.typekit.net/af/cc6127/00000000000000007735b904/30/	22 KB 22 KB	53ms 15ms	Font application/font-woff2	2a02:26f0:3500:16::215:149a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/cc6127/00000000000000007735b904/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n8&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pmd7cky.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 8b3d63582f102c09b0569a1c48c09cbfdd5379138c2284db554f52a4a005a46f Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pmd7cky.css Origin https://www.kroll.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT server nginx etag "a75b36b43118707b7b5c1ffadc4989706090b88e" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 22608
GET H2	200	l use.typekit.net/af/0fa94e/00000000000000007735a098/30/	20 KB 20 KB	55ms 17ms	Font application/font-woff2	2a02:26f0:3500:16::215:149a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/0fa94e/00000000000000007735a098/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pmd7cky.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 4d612da165bfae98c86fde27c80b48ee65eabc425f8d2c916f6dca0e09fe02b3 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pmd7cky.css Origin https://www.kroll.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT server nginx etag "e6cdd128d302fc151cf53e279ed70d832b77d2aa" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 20024
GET H2	200	l use.typekit.net/af/7ac87a/00000000000000007735b8f0/30/	22 KB 22 KB	64ms 27ms	Font application/font-woff2	2a02:26f0:3500:16::215:149a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/7ac87a/00000000000000007735b8f0/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pmd7cky.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:149a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash ef4dfeb8629df21ab8939a77ed8c83a0cd69142b66e3bf2d94f1c1284092c40d Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://use.typekit.net/pmd7cky.css Origin https://www.kroll.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT server nginx etag "0e49eef4170a0f869d093451710f6ed87674d9c1" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 22388
GET H/1.1	200 OK	laurie-iacono.png www.kroll.com/-/jssmedia/kroll-images/headshots/	3 KB 4 KB	163ms 145ms	Image image/webp	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.kroll.com/-/jssmedia/kroll-images/headshots/laurie-iacono.png?h=160&iar=0&w=140&hash=34D0182123A05076D53F9DEBA7129ADA&mw=640 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b36d65d88f8cc5df880d031c6cd169dd7380dd4575c0458258d33cb8f9e929fc Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:48 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff CF-Cache-Status HIT x-permitted-cross-domain-policies none Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Age 337319 Content-Disposition inline; filename="laurie-iacono.webp" Connection keep-alive Content-Length 3376 X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Tue, 09 Aug 2022 08:30:50 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare ETag 88771477ae57415e9b8f7dda1121428a Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/webp Cache-Control public, max-age=604800,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) Accept-Ranges bytes CF-Ray 88392af71f8739ec-FRA
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	26ms 6ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWHXW75 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 14 May 2024 05:41:03 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 6405 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Tue, 14 May 2024 07:41:03 GMT
GET H2	204	0 bat.bing.com/action/	0 285 B	32ms 32ms	Image text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56180571&tm=gtm002&Ver=2&mid=a9ff7e67-f7d5-47e9-a4ff-12e29968b49d&sid=76edcf7011c311efac40b53321b47bd9&vid=76eddaf011c311ef87e3eb9629eac9f7&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=CACTUS%20ransomware%20%7C%20Cyber%20Threat%20Intelligence%20%7C%20Kroll&kw=cactus,%20ransomware,%20encryption,%20threat%20intelligence,%20VPN%20vulnerabilities&p=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&r=&evt=pageLoad&sv=1&rn=944365 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 14 May 2024 07:27:47 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 074C0B5C2063481AA004E4D4781CBE1B Ref B: FRAEDGE1306 Ref C: 2024-05-14T07:27:48Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	4 B 208 B	14ms 13ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=881358807&t=pageview&_s=1&dl=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&ul=de-de&de=UTF-8&dt=CACTUS%20ransomware%20%7C%20Cyber%20Threat%20Intelligence%20%7C%20Kroll&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAEK~&jid=458588944&gjid=1413392887&cid=1532348893.1715671668&tid=UA-7299730-1&_gid=760223186.1715671668&_r=1&_slc=1&gtm=45He45d0n81PWHXW75v79996530za200&cd5=1715671668326.yfrngsmm&cd6=2024-05-14%20Time%3A%2009%3A27%3A48.326%20%2B02%3A00&cd8=&cd9=GTM-PWHXW75%3B%20version%20ID%3A%20280&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&cd4=1532348893.1715671668&cd7=pageview&npa=1&z=300611179 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 14 May 2024 07:27:48 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.kroll.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 151 B	19ms 19ms	XHR text/plain	2a00:1450:400c:c00::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-7299730-1&cid=1532348893.1715671668&jid=458588944&gjid=1413392887&_gid=760223186.1715671668&npa=1&_u=YCDACEAABAAAACAEK~&z=1670747993 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Tue, 14 May 2024 07:27:48 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.kroll.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	33ms 17ms	Image image/gif	142.250.185.196 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-7299730-1&cid=1532348893.1715671668&jid=458588944&npa=1&_u=YCDACEAABAAAACAEK~&z=2030509980 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.196 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s52-in-f4.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 14 May 2024 07:27:48 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	18ms 18ms	Image image/gif	142.250.186.35 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-7299730-1&cid=1532348893.1715671668&jid=458588944&npa=1&_u=YCDACEAABAAAACAEK~&z=2030509980 Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.35 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 14 May 2024 07:27:48 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	iframe_api Show response www.youtube.com/	993 B 2 KB	42ms 22ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/684-0d837124b1e48847.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 21611496da46783ac76e2a0dbc39bfab73f4aad4e97cc29b78bf57a7d934217c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-encoding br p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info." cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version server ESF x-frame-options SAMEORIGIN report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} content-type text/javascript; charset=utf-8 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version cache-control private, max-age=0 origin-trial AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" expires Tue, 14 May 2024 07:27:48 GMT
GET H/1.1	200 OK	db.js Show response www.kroll.com/	10 KB 4 KB	277ms 277ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/db.js Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 99daf18c937a8390de923b5ae28d03cf9d2b962791d6cdd2bd867bb0a32ab5fd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status MISS Last-Modified Fri, 08 Mar 2024 09:41:45 GMT Server cloudflare ETag W/"2953-18e1d70a73e" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive CF-Ray 88392afe4bb203ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	scroll.js Show response www.kroll.com/	2 KB 1 KB	247ms 247ms	Script application/javascript	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/scroll.js Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 40ef0e345d2b8abb3c638b40221bf5c1c3353966b569a9d83cdff142ce906909 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 Content-Encoding br CF-Cache-Status MISS Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare ETag W/"819-18f19c7a0f5" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive CF-Ray 88392afe7f784dc5-FRA request-context appId=cid-v1:
GET H2	200	OtAutoBlock.js Show response cdn.cookielaw.org/consent/db8fa0ce-73a5-4e3f-9b55-60b230386b60/	9 KB 3 KB	46ms 30ms	Script application/x-javascript	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/db8fa0ce-73a5-4e3f-9b55-60b230386b60/OtAutoBlock.js Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 94eb7c68c2299d112724fe49266a44fe950207c97f26dec0f58058d3f95ac678 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 56903 content-md5 R0KW16TaRHZiSZhjd/yeng== content-length 2639 x-ms-lease-status unlocked last-modified Wed, 01 May 2024 11:42:29 GMT server cloudflare etag 0x8DC69D3C839A79E vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6baaa462-c01e-0032-56d1-9b3680000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392af96dae2c43-FRA expires Wed, 15 May 2024 07:27:48 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	21 KB 7 KB	37ms 22ms	Script application/javascript	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6a2f825beb3b540a044cdb0515177c34497aa2ce92e335bf1498fa42bb5baf88 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Dw6K+rTuf8kOuPIEBw1QQA== age 14 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 6881 x-ms-lease-status unlocked last-modified Mon, 13 May 2024 02:04:03 GMT server cloudflare etag 0x8DC72F0F65BBA2A vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 6c5db382-601e-0039-604f-a501cd000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392af96db02c43-FRA expires Wed, 15 May 2024 07:27:48 GMT
GET H/1.1	200 OK	en Show response api-kroll.kroll.com/sitecore/api/jss/dictionary/kroll/	4 KB 3 KB	457ms 426ms	XHR application/json	2606:4700:4400::ac40:9077 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api-kroll.kroll.com/sitecore/api/jss/dictionary/kroll/en?sc_apikey=%7B30BA3E42-5FB0-4053-BE9E-C2CEA63FA90A%7D Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/684-0d837124b1e48847.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9077 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c2d8d8866cfa789772a0f4a6e40241472c0723707bae3a01bca28782831b0677 Security Headers Name Value Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https://s.gravatar.com https://*.wp.com/cdn.auth0.com/avatars; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept application/json, text/plain, */* Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https://s.gravatar.com https://*.wp.com/cdn.auth0.com/avatars; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; CF-Cache-Status DYNAMIC X-Permitted-Cross-Domain-Policies none Content-Encoding br Transfer-Encoding chunked Connection keep-alive X-XSS-Protection 1; mode=block Request-Context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Pragma no-cache Referrer-Policy same-origin Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare Vary Accept-Encoding X-Frame-Options SAMEORIGIN, SAMEORIGIN Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control no-cache,public Permissions-Policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) CF-RAY 88392af99fd11c3e-FRA Expires -1
GET H2	200	www-widgetapi.js Show response www.youtube.com/s/player/db9cbc4e/www-widgetapi.vflset/	42 KB 14 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/db9cbc4e/www-widgetapi.vflset/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3074d74b47a1fae140faeb7eadb8af0a6634f8262bf2436541d21243389d022d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 13 May 2024 07:34:48 GMT content-encoding br x-content-type-options nosniff age 85980 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 13973 x-xss-protection 0 last-modified Mon, 13 May 2024 04:15:10 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 13 May 2025 07:34:48 GMT
GET H/1.1	200 OK	cyber.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/insights/publications/	2 B 874 B	515ms 514ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/insights/publications/cyber.json?path=insights&path=publications&path=cyber Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/insights/publications/cyber?path=cyber&path=insights&path=publications Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/insights/publications/cyber x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392af98e2aa06a-FRA x-nextjs-rewrite /en/_site_kroll/insights/publications/cyber?path=cyber&path=insights&path=publications Content-Length 2 request-context appId=cid-v1:
GET H/1.1	200 OK	contactus.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/	2 B 764 B	566ms 561ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/contactus.json?path=contactus Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/contactus?path=contactus Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/contactus x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392af99ab5917c-FRA x-nextjs-rewrite /en/_site_kroll/contactus?path=contactus Content-Length 2 request-context appId=cid-v1:
GET H/1.1	200 OK	hotlines.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/	2 B 759 B	613ms 532ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/hotlines.json?path=hotlines Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/hotlines?path=hotlines Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/hotlines x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392afa0ebb03ec-FRA x-nextjs-rewrite /en/_site_kroll/hotlines?path=hotlines Content-Length 2 request-context appId=cid-v1:
GET H/1.1	200 OK	services.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/	2 B 759 B	1037ms 531ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/services.json?path=services Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/services?path=services Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/services x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392afcbe3039ec-FRA x-nextjs-rewrite /en/_site_kroll/services?path=services Content-Length 2 request-context appId=cid-v1:
GET H/1.1	200 OK	terms-of-use.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/	2 B 779 B	1116ms 600ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/terms-of-use.json?path=terms-of-use Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/terms-of-use?path=terms-of-use Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/terms-of-use x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392afcca23a06a-FRA x-nextjs-rewrite /en/_site_kroll/terms-of-use?path=terms-of-use Content-Length 2 request-context appId=cid-v1:
GET H/1.1	200 OK	privacy-policy.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/	2 B 789 B	787ms 252ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/privacy-policy.json?path=privacy-policy Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/privacy-policy?path=privacy-policy Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/privacy-policy x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392afceda14dc5-FRA x-nextjs-rewrite /en/_site_kroll/privacy-policy?path=privacy-policy Content-Length 2 request-context appId=cid-v1:
GET H/1.1	200 OK	kroll-intrusion-lifecycle.json Show response www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/insights/publications/cyber/	2 B 1014 B	1141ms 575ms	Fetch	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/data/uHimoO12Tb73jwnI1B-P_/en/insights/publications/cyber/kroll-intrusion-lifecycle.json?path=insights&path=publications&path=cyber&path=kroll-intrusion-lifecycle Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" purpose prefetch x-nextjs-data 1 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection x-middleware-prefetch 1 sec-ch-ua-platform "Win32" Response headers x-middleware-rewrite /en/_site_kroll/insights/publications/cyber/kroll-intrusion-lifecycle?path=cyber&path=insights&path=kroll-intrusion-lifecycle&path=publications Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status DYNAMIC Server cloudflare x-sc-rewrite /_site_kroll/insights/publications/cyber/kroll-intrusion-lifecycle x-middleware-skip 1 Vary Accept-Encoding Connection keep-alive CF-Ray 88392afd1ec4917c-FRA x-nextjs-rewrite /en/_site_kroll/insights/publications/cyber/kroll-intrusion-lifecycle?path=cyber&path=insights&path=kroll-intrusion-lifecycle&path=publications Content-Length 2 request-context appId=cid-v1:
GET H2	200	db8fa0ce-73a5-4e3f-9b55-60b230386b60.json Show response cdn.cookielaw.org/consent/db8fa0ce-73a5-4e3f-9b55-60b230386b60/	5 KB 2 KB	43ms 29ms	XHR application/x-javascript	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/db8fa0ce-73a5-4e3f-9b55-60b230386b60/db8fa0ce-73a5-4e3f-9b55-60b230386b60.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c4389db5751a5478ab72fd84bb8142e984213cb681f2659f9996b1d4415005d5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 58074 content-md5 mAFNYXo7uf/TbKRaqqdYSg== content-length 1669 x-ms-lease-status unlocked last-modified Wed, 01 May 2024 11:42:29 GMT server cloudflare etag 0x8DC69D3C837D31F vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 4b1945e8-f01e-004b-43d1-9bcaa4000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392af9affb9066-FRA expires Wed, 15 May 2024 07:27:48 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	66 B 312 B	50ms 31ms	XHR application/json	2606:4700:4400::ac40:9b77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" accept application/json Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * cf-ray 88392af9ffcb9968-FRA access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202404.1.0/	448 KB 109 KB	20ms 20ms	Script application/javascript	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 49cfbb9c8b20fbaab3a11bcecb48fb8448e617a746fa578baca0dc71a7e06540 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 lAa4newgeifCObgQn9TUrg== age 62339 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 111087 x-ms-lease-status unlocked last-modified Mon, 06 May 2024 02:33:25 GMT server cloudflare etag 0x8DC6D74E83907A1 vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 1a756b73-001e-00aa-6dbe-9f9786000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392afa3e722c43-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/db8fa0ce-73a5-4e3f-9b55-60b230386b60/d87195ba-5a5c-4435-a0e1-498daa2d26df/	60 KB 16 KB	27ms 27ms	Fetch application/x-javascript	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/db8fa0ce-73a5-4e3f-9b55-60b230386b60/d87195ba-5a5c-4435-a0e1-498daa2d26df/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e5cc0f081745f156ebe1d70e3e6e36163ad2fd2d3d84d8e4184a86f6186eb560 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 58073 content-md5 1oUVn4KERoSC6LvEzv/ZEw== content-length 16509 x-ms-lease-status unlocked last-modified Wed, 01 May 2024 11:42:40 GMT server cloudflare etag 0x8DC69D3CE5FEC2E vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 5e87972c-f01e-0016-0ed1-9bc020000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392afa78eb9066-FRA expires Wed, 15 May 2024 07:27:48 GMT
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/202404.1.0/assets/	13 KB 3 KB	29ms 29ms	Fetch application/json	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202404.1.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 CeHoS/yftP1uT8S/ram0PA== age 56651 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 3041 x-ms-lease-status unlocked last-modified Mon, 06 May 2024 02:33:19 GMT server cloudflare etag 0x8DC6D74E465AB77 vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id cc30c84e-901e-008d-43bf-9f0dcf000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392afab92b9066-FRA
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/202404.1.0/assets/v2/	63 KB 13 KB	30ms 30ms	Fetch application/json	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202404.1.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7465924993bbca3c35db5e27f00d48e1b718c7e82bf610926f9f388bfb13c2e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 gGZDD4IrrtJiXD9elAiGDw== age 57198 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 13627 x-ms-lease-status unlocked last-modified Mon, 06 May 2024 02:33:22 GMT server cloudflare etag 0x8DC6D74E605FF38 vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id 2ef17877-101e-0014-61bf-9f820d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392afab92d9066-FRA
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202404.1.0/assets/	24 KB 4 KB	21ms 20ms	Fetch text/css	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202404.1.0/assets/otCommonStyles.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 4ErYmXXFNbMLrnc9DrDTsg== age 56746 x-ms-lease-status unlocked last-modified Mon, 06 May 2024 02:33:30 GMT server cloudflare vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id d98e5f8e-c01e-0070-6ebf-9f32ad000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 88392afab92f9066-FRA
GET H/1.1	200 OK	ot_close learn.kroll.com/-/media/kroll-images/aboutus/images/	854 B 2 KB	104ms 68ms	Image image/svg+xml	2606:4700:4400::ac40:9077 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://learn.kroll.com/-/media/kroll-images/aboutus/images/ot_close Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/css/d35a04353948afe1.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9077 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 88158137f0bd3e348d6d208070e5b0176fb2e06f53847dbf849ae86632444dd0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:49 GMT Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://duffandphelps.360learning.com CF-Cache-Status HIT x-permitted-cross-domain-policies none Age 474718 Transfer-Encoding chunked Content-Encoding br Content-Disposition inline; filename="ot_close.svg" Connection keep-alive X-XSS-Protection 1; mode=block request-context appId=cid-v1:3dfd2907-6c9e-41e0-a442-0b72cda5bba8 Referrer-Policy same-origin Last-Modified Wed, 28 Feb 2024 11:25:18 GMT accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness Server cloudflare Vary Accept-Encoding X-Frame-Options SAMEORIGIN Content-Type image/svg+xml Cache-Control public, max-age=604529,public permissions-policy accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self) CF-RAY 88392afb3bad9b69-FRA
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 489 B	20ms 20ms	Fetch image/svg+xml	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202404.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 tXyZydHjxQshFMbbBT1/8A== age 56746 x-ms-lease-status unlocked last-modified Mon, 13 May 2024 02:04:04 GMT server cloudflare vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id ba93b39d-701e-000f-5742-a5ac9f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 88392afb09789066-FRA
GET H2	200	Kroll.png cdn.cookielaw.org/logos/0453826c-66bd-4b22-8370-04eafb384ea3/db8fa0ce-73a5-4e3f-9b55-60b230386b60/cfc094b9-8d06-43f4-ba32-1d34cd6a668d/	12 KB 12 KB	21ms 21ms	Image image/png	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/0453826c-66bd-4b22-8370-04eafb384ea3/db8fa0ce-73a5-4e3f-9b55-60b230386b60/cfc094b9-8d06-43f4-ba32-1d34cd6a668d/Kroll.png Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 74bfd6cab6c8204b1b9a82df0724714101b96af65bc74df3ed192c10471e3323 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-md5 /pX6N7rNfVMyKKEcFftBrQ== age 77839 content-length 12029 x-ms-lease-status unlocked last-modified Mon, 24 Jan 2022 12:37:00 GMT server cloudflare etag 0x8D9DF36377B5B26 vary Accept-Encoding content-type image/png access-control-allow-origin * x-ms-request-id fbbd6a9f-101e-0041-749a-226167000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 88392afb0f522c43-FRA
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	20ms 20ms	Image image/svg+xml	2606:4700::6813:b234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Requested by Host: www.kroll.com URL: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Tue, 14 May 2024 07:27:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 Y+c301RBZNK39PvKQWrIBw== age 25794 x-ms-lease-status unlocked last-modified Mon, 13 May 2024 02:04:05 GMT server cloudflare vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 2767d4df-001e-004f-2e68-a58571000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 88392afb0f542c43-FRA
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 194 B	191ms 191ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept * Referer https://www.kroll.com/ sec-ch-ua-platform "Win32" Response headers date Tue, 14 May 2024 07:27:49 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: F6DDED5BFDCD4C9494141604728BEB1D Ref B: FRAEDGE1207 Ref C: 2024-05-14T07:27:49Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 access-control-allow-origin https://www.kroll.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYYZPBmKn7ookeBhmsA2A==
GET H/1.1	200 OK	e42805f0776a68d8.css Show response www.kroll.com/_next/static/css/	56 KB 0	0ms 0ms	Fetch text/css	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/css/e42805f0776a68d8.css Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15a38e578f0088db5a5b4ec7089d28b4b6e2f39943b7fae9e5fe364e5b1bbc0c Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:47 GMT Content-Encoding br CF-Cache-Status HIT Last-Modified Wed, 03 Jan 2024 13:56:02 GMT Server cloudflare Age 5313349 ETag W/"dfd0-18ccf9c1773" Vary Accept-Encoding Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=31536000, immutable CF-Ray 88392af3ef5fa06a-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	e2767bd096bfb193.css Show response www.kroll.com/_next/static/css/	18 KB 0	1ms 1ms	Fetch text/css	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/_next/static/css/e2767bd096bfb193.css Requested by Host: www.kroll.com URL: https://www.kroll.com/_next/static/chunks/main-bff998b1b6a9dce5.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe9eeacc872e2235a6fa9251f2f697439e93d94932edffaec82cb085eefb9087 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:47 GMT Content-Encoding br CF-Cache-Status HIT Last-Modified Fri, 26 Apr 2024 09:41:04 GMT Server cloudflare Age 1547106 ETag W/"463b-18f19c7a0b7" Vary Accept-Encoding Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=31536000, immutable CF-Ray 88392af3e87303ec-FRA request-context appId=cid-v1:
GET H/1.1	200 OK	favicon.png www.kroll.com/	22 KB 23 KB	241ms 240ms	Other image/png	2606:4700:4400::6812:2b89 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.kroll.com/favicon.png?mw=32&mh=32 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2b89 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bbc9afb080826c41e45a20d57ae8e4852ada3895441ddbb93a2cf2222aea007b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 14 May 2024 07:27:50 GMT Strict-Transport-Security max-age=31536000 CF-Cache-Status MISS Last-Modified Wed, 03 Jan 2024 13:56:02 GMT Server cloudflare ETag W/"586e-18ccf9c180f" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes CF-Ray 88392b00199739ec-FRA Content-Length 22638 request-context appId=cid-v1:
POST H2	204	collect region1.analytics.google.com/g/	0 54 B	14ms 13ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-S0E5692XKD&gtm=45je45d0v882864807z879996530za200&_p=1715671667819&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1532348893.1715671668&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&sid=1715671668&sct=1&seg=0&dl=https%3A%2F%2Fwww.kroll.com%2Fen%2Finsights%2Fpublications%2Fcyber%2Fcactus-ransomware-prickly-new-variant-evades-detection&dt=CACTUS%20ransomware%20%7C%20Cyber%20Threat%20Intelligence%20%7C%20Kroll&_s=2&tfd=6454 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-S0E5692XKD&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://www.kroll.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Tue, 14 May 2024 07:27:53 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.kroll.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT