urlscan.io logo urlscan.io
SecurityTrails logo

www.golem.de Open in urlscan Pro
2a00:13c8:f5::f:4b3d:148  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Submission: On June 11 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 77 IPs in 13 countries across 61 domains to perform 275 HTTP transactions. The main IP is 2a00:13c8:f5::f:4b3d:148, located in Germany and belongs to SYSELEVEN SysEleven GmbH, DE. The main domain is www.golem.de.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on July 29th 2019. Valid for: a year.
This is the only time www.golem.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
34 2a00:13c8:f5:... 25291 (SYSELEVEN...)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
5 2a00:13c8:f5:... 25291 (SYSELEVEN...)
1 2a00:13c8:f5:... 25291 (SYSELEVEN...)
2 2a00:13c8:f5:... 25291 (SYSELEVEN...)
1 91.215.103.64 43407 (INFONLINE-AS)
1 2 161.156.66.184 36351 (SOFTLAYER)
15 172.217.22.34 15169 (GOOGLE)
1 13.225.87.121 16509 (AMAZON-02)
2 184.51.8.201 16625 (AKAMAI-AS)
3 9 23.56.30.78 16625 (AKAMAI-AS)
2 2 2600:9000:20e... 16509 (AMAZON-02)
2 2600:9000:21f... 16509 (AMAZON-02)
16 151.101.13.44 54113 (FASTLY)
17 2a00:1450:400... 15169 (GOOGLE)
2 151.101.113.194 54113 (FASTLY)
3 13.224.199.29 16509 (AMAZON-02)
7 3.123.131.98 16509 (AMAZON-02)
1 1 2a02:2638::1c 44788 (ASN-CRITE...)
1 178.250.0.157 44788 (ASN-CRITE...)
3 184.51.9.98 16625 (AKAMAI-AS)
1 178.250.2.131 44788 (ASN-CRITE...)
10 37.157.6.241 198622 (ADFORM)
1 3.124.56.61 16509 (AMAZON-02)
2 23.63.115.52 16625 (AKAMAI-AS)
3 6 185.33.221.13 29990 (ASN-APPNEX)
2 104.16.68.69 13335 (CLOUDFLAR...)
1 35.206.134.202 15169 (GOOGLE)
1 35.244.159.8 15169 (GOOGLE)
4 69.173.144.140 26667 (RUBICONPR...)
3 185.86.139.96 201081 (SMARTADSE...)
1 185.64.189.112 62713 (AS-PUBMATIC)
1 193.46.63.75 43407 (INFONLINE-AS)
1 2 91.215.103.65 43407 (INFONLINE-AS)
1 142.93.100.57 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:13c8:f5:... 25291 (SYSELEVEN...)
1 2a00:13c8:f5:... 25291 (SYSELEVEN...)
1 3 104.96.130.160 16625 (AKAMAI-AS)
8 136.243.33.79 24940 (HETZNER-AS)
2 6 52.58.42.46 16509 (AMAZON-02)
1 3 23.63.149.97 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
2 176.74.59.146 25291 (SYSELEVEN...)
7 95.216.24.148 24940 (HETZNER-AS)
2 16 151.101.113.44 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
2 2 18.194.102.89 16509 (AMAZON-02)
1 1 69.173.144.138 26667 (RUBICONPR...)
2 2 40.113.136.100 8075 (MICROSOFT...)
4 4 185.29.132.30 30419 (MEDIAMATH...)
9 141.226.228.48 200478 (TABOOLA-AS)
1 1 198.148.27.140 19189 (PULSEPOINT)
2 2 185.184.8.30 204995 (RTB-HOUSE...)
2 2 70.42.32.191 22075 (AS-OUTBRAIN)
2 2 216.58.207.66 15169 (GOOGLE)
1 185.64.190.80 62713 (AS-PUBMATIC)
2 2 34.252.71.88 16509 (AMAZON-02)
1 1 44.231.125.220 16509 (AMAZON-02)
1 192.132.33.46 18568 (BIDTELLECT)
2 141.226.224.32 200478 (TABOOLA-AS)
3 3 35.156.5.228 16509 (AMAZON-02)
2 2 136.243.75.32 24940 (HETZNER-AS)
2 2a02:2638:1::3 44788 (ASN-CRITE...)
2 8 35.190.94.1 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 146.148.127.183 15169 (GOOGLE)
15 37.157.6.236 198622 (ADFORM)
1 18.196.193.20 16509 (AMAZON-02)
1 18.194.230.189 16509 (AMAZON-02)
5 5 80.74.154.241 21069 (ASN-METAN...)
5 46.231.207.222 21069 (ASN-METAN...)
2 52.18.221.188 16509 (AMAZON-02)
1 151.101.13.108 54113 (FASTLY)
1 34.98.64.218 15169 (GOOGLE)
1 184.51.9.34 16625 (AKAMAI-AS)
1 104.111.230.142 16625 (AKAMAI-AS)
4 89.163.159.106 24961 (MYLOC-AS ...)
1 62.168.44.118 5588 (GTSCE GTS...)
2 99.81.188.151 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
1 35.186.238.175 15169 (GOOGLE)
1 13.225.87.60 16509 (AMAZON-02)
1 2600:9000:215... 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
1 34.253.51.81 16509 (AMAZON-02)
1 34.242.91.228 16509 (AMAZON-02)
275 77
34    2a00:13c8:f5::f:4b3d:148 (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
www.golem.de
1    2a02:26f0:10c::5f64:c11b (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
cdn.stroeerdigitalgroup.de
5    2a00:13c8:f5::f:4b3d:181 (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
cpxl.golem.de
1    2a00:13c8:f5::f:4b3d:175 (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
video.golem.de
2    2a00:13c8:f5::f:4b3d:17a (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
ads.golem.de
1    91.215.103.64 (Germany)

ASN43407 (INFONLINE-AS, NL)
PTR: script3.ioam.de
script.ioam.de
2    161.156.66.184 (United States)

ASN36351 (SOFTLAYER, US)
PTR: b8.42.9ca1.ip4.static.sl-reverse.com
ssl-golem.met.vgwort.de
15    172.217.22.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f2.1e100.net
securepubads.g.doubleclick.net
1    13.225.87.121 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-121.fra2.r.cloudfront.net
cdn-a.yieldlove.com
2    184.51.8.201 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-51-8-201.deploy.static.akamaitechnologies.com
s400.mxcdn.net
s385.mxcdn.net
9    23.56.30.78 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-56-30-78.deploy.static.akamaitechnologies.com
tracking.m6r.eu
2    2600:9000:20eb:3c00:12:6213:9cc0:93a1 (United States)

ASN16509 (AMAZON-02, US)
si.nuggad.net
2    2600:9000:21f3:f600:1f:a1b:34c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
nugmw.userreport.com
16    151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
cdn.taboola.com
match.zorosrv.com
images.taboola.com
17    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
adservice.google.ch
adservice.google.com
www.googletagservices.com
2    151.101.113.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
confiant-integrations.global.ssl.fastly.net
clarium.global.ssl.fastly.net
3    13.224.199.29 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-199-29.fra2.r.cloudfront.net
c.amazon-adsystem.com
7    3.123.131.98 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
prod-ingestion.tracking.v2.yieldlove-ad-serving.net
1    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
1    178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
3    184.51.9.98 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-51-9-98.deploy.static.akamaitechnologies.com
as-sec.casalemedia.com
js-sec.indexww.com
1    178.250.2.131 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.am5.vip.prod.criteo.com
bidder.criteo.com
10    37.157.6.241 (Denmark)

ASN198622 (ADFORM, DK)
adx.adform.net
track.adform.net
1    3.124.56.61 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-56-61.eu-central-1.compute.amazonaws.com
hb.adscale.de
2    23.63.115.52 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-63-115-52.deploy.static.akamaitechnologies.com
ad.yieldlab.net
6    185.33.221.13 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
2    104.16.68.69 (United States)

ASN13335 (CLOUDFLARENET, US)
dmx.districtm.io
cdn.districtm.io
1    35.206.134.202 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 202.134.206.35.bc.googleusercontent.com
orbidder.otto.de
1    35.244.159.8 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
yieldlove-d.openx.net
4    69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
3    185.86.139.96 (France)

ASN201081 (SMARTADSERVER, FR)
prg.smartadserver.com
1    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
1    193.46.63.75 (Alfter, Germany)

ASN43407 (INFONLINE-AS, NL)
PTR: irqs.ioam.de
irqs.ioam.de
2    91.215.103.65 (Germany)

ASN43407 (INFONLINE-AS, NL)
PTR: de3.ioam.de
de.ioam.de
1    142.93.100.57 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)
cdn.onthe.io
1    2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:13c8:f5::f:4b3d:180 (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
account.golem.de
1    2a00:13c8:f5::f:4b3d:182 (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
cpx.golem.de
3    104.96.130.160 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-130-160.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
8    136.243.33.79 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: h380.meetrics.de
lb52.s400.meetrics.net
6    52.58.42.46 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-42-46.eu-central-1.compute.amazonaws.com
ih.adscale.de
3    23.63.149.97 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-63-149-97.deploy.static.akamaitechnologies.com
cdn.m6r.eu
js.adscale.de
3    2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:81a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
401aed45362298ea2e6087654ef70265.safeframe.googlesyndication.com
6    2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
3    2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    176.74.59.146 (Germany)

ASN25291 (SYSELEVEN SysEleven GmbH, DE)
PTR: a2a-admin.golem.de
a2a-cs.golem.de
a2a-static.golem.de
7    95.216.24.148 (Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.148.24.216.95.clients.your-server.de
tt.onthe.io
16    151.101.113.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
trc.taboola.com
match.taboola.com
1    2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    18.194.102.89 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-102-89.eu-central-1.compute.amazonaws.com
rtb.mfadsrvr.com
1    69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    40.113.136.100 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.powerlinks.com
4    185.29.132.30 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
9    141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)
am-sync.taboola.com
trc-events.taboola.com
1    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
2    185.184.8.30 (Poland)

ASN204995 (RTB-HOUSE-AMS, NL)
PTR: ip-185-184-8-30.rtbhouse.net
creativecdn.com
ams.creativecdn.com
2    70.42.32.191 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
2    216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net
cm.g.doubleclick.net
1    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
2    34.252.71.88 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-71-88.eu-west-1.compute.amazonaws.com
match.adsrvr.org
1    44.231.125.220 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-231-125-220.us-west-2.compute.amazonaws.com
www.storygize.net
1    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
2    141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)
cds.taboola.com
3    35.156.5.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-5-228.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    136.243.75.32 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: hosting.adhigh.net
px.adhigh.net
2    2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
static.criteo.net
8    35.190.94.1 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 1.94.190.35.bc.googleusercontent.com
ad4m.at
1    2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
42a5e1dcd8b9fdf4787e04106aaf119c.safeframe.googlesyndication.com
2    146.148.127.183 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 183.127.148.146.bc.googleusercontent.com
ad4mat.net
15    37.157.6.236 (Denmark)

ASN198622 (ADFORM, DK)
s1.adform.net
1    18.196.193.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-193-20.eu-central-1.compute.amazonaws.com
protected-by.clarium.io
1    18.194.230.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-230-189.eu-central-1.compute.amazonaws.com
api.yieldlove-ad-serving.net
5    80.74.154.241 (Switzerland)

ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH)
PTR: m10c2311.sui-inter.net
balancer.sitebarad.com
5    46.231.207.222 (Switzerland)

ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH)
PTR: rc18v1202.dnh.net
pipe06.sitebarad.com
2    52.18.221.188 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-221-188.eu-west-1.compute.amazonaws.com
io.fusedeck.net
1    151.101.13.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
acdn.adnxs.com
1    34.98.64.218 (United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
eu-u.openx.net
1    184.51.9.34 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-51-9-34.deploy.static.akamaitechnologies.com
ads.pubmatic.com
1    104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
4    89.163.159.106 (Cloppenburg, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
dmp.theadex.com
1    62.168.44.118 (Prague, Czech Republic)

ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ)
PTR: cdn2.bbmedia.cz
bbcdn-bbnaut.ibillboard.com
2    99.81.188.151 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-188-151.eu-west-1.compute.amazonaws.com
ups.xplosion.de
1    2600:9000:20eb:5a00:15:efbc:e300:93a1 (United States)

ASN16509 (AMAZON-02, US)
js.agkn.com
1    35.186.238.175 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 175.238.186.35.bc.googleusercontent.com
de-gmtdmp.mookie1.com
1    13.225.87.60 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-60.fra2.r.cloudfront.net
sak.userreport.com
1    2600:9000:2156:e400:11:af01:b40:93a1 (United States)

ASN16509 (AMAZON-02, US)
tag.userreport.com
1    2600:9000:20eb:fa00:1c:8c89:a300:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.emetriq.de
1    2600:9000:20eb:bc00:19:fc2c:a140:93a1 (United States)

ASN16509 (AMAZON-02, US)
d.agkn.com
1    34.253.51.81 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-51-81.eu-west-1.compute.amazonaws.com
cdn.adrtx.net
1    34.242.91.228 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-242-91-228.eu-west-1.compute.amazonaws.com
adstax-match.adrtx.net
Apex Domain
Subdomains		 Transfer
46 golem.de
www.golem.de
cpxl.golem.de
video.golem.de
ads.golem.de
account.golem.de
cpx.golem.de
a2a-cs.golem.de
a2a-static.golem.de
596 KB
42 taboola.com
cdn.taboola.com
trc.taboola.com
match.taboola.com
am-sync.taboola.com
cds.taboola.com
images.taboola.com
trc-events.taboola.com
292 KB
25 adform.net
adx.adform.net
track.adform.net
s1.adform.net
164 KB
21 doubleclick.net
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
219 KB
17 googlesyndication.com
pagead2.googlesyndication.com
401aed45362298ea2e6087654ef70265.safeframe.googlesyndication.com
tpc.googlesyndication.com
42a5e1dcd8b9fdf4787e04106aaf119c.safeframe.googlesyndication.com
144 KB
10 sitebarad.com
balancer.sitebarad.com
pipe06.sitebarad.com
230 KB
10 m6r.eu
tracking.m6r.eu
cdn.m6r.eu
7 KB
9 adscale.de
hb.adscale.de
ih.adscale.de
js.adscale.de
11 KB
8 ad4m.at
ad4m.at
34 KB
8 meetrics.net
lb52.s400.meetrics.net
2 KB
8 onthe.io
cdn.onthe.io
tt.onthe.io
29 KB
8 yieldlove-ad-serving.net
prod-ingestion.tracking.v2.yieldlove-ad-serving.net
api.yieldlove-ad-serving.net
604 B
7 adnxs.com
ib.adnxs.com
acdn.adnxs.com
7 KB
6 rubiconproject.com
fastlane.rubiconproject.com
pixel.rubiconproject.com
eus.rubiconproject.com
7 KB
5 googletagservices.com
www.googletagservices.com
138 KB
4 theadex.com
dmp.theadex.com
15 KB
4 mathtag.com
sync.mathtag.com
3 KB
4 userreport.com
nugmw.userreport.com
sak.userreport.com
tag.userreport.com
25 KB
4 ioam.de
script.ioam.de
irqs.ioam.de
de.ioam.de
13 KB
3 bidswitch.net
x.bidswitch.net
1 KB
3 google-analytics.com
www.google-analytics.com
18 KB
3 scorecardresearch.com
sb.scorecardresearch.com
3 KB
3 pubmatic.com
hbopenbid.pubmatic.com
simage2.pubmatic.com
ads.pubmatic.com
1 KB
3 smartadserver.com
prg.smartadserver.com
4 KB
3 criteo.com
gum.criteo.com
mug.criteo.com
bidder.criteo.com
1 KB
3 amazon-adsystem.com
c.amazon-adsystem.com
34 KB
2 adrtx.net
cdn.adrtx.net
adstax-match.adrtx.net
849 B
2 agkn.com
js.agkn.com
d.agkn.com
3 KB
2 xplosion.de
ups.xplosion.de
4 KB
2 fusedeck.net
io.fusedeck.net
33 KB
2 ad4mat.net
ad4mat.net
2 criteo.net
static.criteo.net
41 KB
2 adhigh.net
px.adhigh.net
938 B
2 adsrvr.org
match.adsrvr.org
915 B
2 zemanta.com
b1sync.zemanta.com
1 KB
2 creativecdn.com
creativecdn.com
ams.creativecdn.com
725 B
2 powerlinks.com
px.powerlinks.com
1 KB
2 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
2 openx.net
yieldlove-d.openx.net
eu-u.openx.net
1 KB
2 districtm.io
dmx.districtm.io
cdn.districtm.io
424 B
2 yieldlab.net
ad.yieldlab.net
2 KB
2 casalemedia.com
as-sec.casalemedia.com
3 KB
2 fastly.net
confiant-integrations.global.ssl.fastly.net
clarium.global.ssl.fastly.net
28 KB
2 google.ch
adservice.google.ch
1 KB
2 nuggad.net
si.nuggad.net
1016 B
2 mxcdn.net
s400.mxcdn.net
s385.mxcdn.net
53 KB
2 vgwort.de
ssl-golem.met.vgwort.de
777 B
1 emetriq.de
cdn.emetriq.de
2 KB
1 mookie1.com
de-gmtdmp.mookie1.com
608 B
1 ibillboard.com
bbcdn-bbnaut.ibillboard.com
316 B
1 indexww.com
js-sec.indexww.com
1 clarium.io
protected-by.clarium.io
345 B
1 bttrack.com
bttrack.com
380 B
1 storygize.net
www.storygize.net
430 B
1 contextweb.com
bh.contextweb.com
692 B
1 zorosrv.com
match.zorosrv.com
388 B
1 googletagmanager.com
www.googletagmanager.com
33 KB
1 otto.de
orbidder.otto.de
146 B
1 google.com
adservice.google.com
952 B
1 yieldlove.com
cdn-a.yieldlove.com
112 KB
1 stroeerdigitalgroup.de
cdn.stroeerdigitalgroup.de
60 KB
275 61
Domain Requested by
34 www.golem.de www.golem.de
cdn.stroeerdigitalgroup.de
s400.mxcdn.net
15 s1.adform.net clarium.global.ssl.fastly.net
s1.adform.net
www.golem.de
15 trc.taboola.com 1 redirects cdn.taboola.com
www.golem.de
15 securepubads.g.doubleclick.net cdn.stroeerdigitalgroup.de
securepubads.g.doubleclick.net
www.golem.de
9 pagead2.googlesyndication.com www.golem.de
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
9 tracking.m6r.eu 3 redirects www.golem.de
tracking.m6r.eu
8 ad4m.at 2 redirects securepubads.g.doubleclick.net
ad4m.at
8 images.taboola.com www.golem.de
8 lb52.s400.meetrics.net www.golem.de
7 track.adform.net clarium.global.ssl.fastly.net
s1.adform.net
www.golem.de
7 am-sync.taboola.com www.golem.de
7 tt.onthe.io cdn.onthe.io
7 prod-ingestion.tracking.v2.yieldlove-ad-serving.net cdn-a.yieldlove.com
7 cdn.taboola.com www.golem.de
cdn.taboola.com
6 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
pagead2.googlesyndication.com
6 ih.adscale.de 2 redirects www.golem.de
js.adscale.de
6 ib.adnxs.com 3 redirects cdn-a.yieldlove.com
www.golem.de
5 pipe06.sitebarad.com www.golem.de
5 balancer.sitebarad.com 5 redirects
5 www.googletagservices.com pagead2.googlesyndication.com
securepubads.g.doubleclick.net
5 cpxl.golem.de www.golem.de
4 dmp.theadex.com cdn.stroeerdigitalgroup.de
dmp.theadex.com
4 sync.mathtag.com 4 redirects
4 fastlane.rubiconproject.com cdn-a.yieldlove.com
3 x.bidswitch.net 3 redirects
3 www.google-analytics.com 1 redirects www.googletagmanager.com
www.golem.de
3 googleads.g.doubleclick.net pagead2.googlesyndication.com
3 sb.scorecardresearch.com 1 redirects cdn.taboola.com
www.golem.de
3 prg.smartadserver.com cdn-a.yieldlove.com
3 adx.adform.net cdn-a.yieldlove.com
www.golem.de
3 c.amazon-adsystem.com cdn-a.yieldlove.com
c.amazon-adsystem.com
2 ups.xplosion.de cdn.stroeerdigitalgroup.de
cdn.emetriq.de
2 trc-events.taboola.com cdn.taboola.com
2 io.fusedeck.net www.golem.de
2 ad4mat.net ad4m.at
2 static.criteo.net cdn-a.yieldlove.com
static.criteo.net
2 px.adhigh.net 2 redirects
2 cds.taboola.com www.golem.de
2 match.adsrvr.org 2 redirects
2 cm.g.doubleclick.net 2 redirects
2 b1sync.zemanta.com 2 redirects
2 px.powerlinks.com 2 redirects
2 rtb.mfadsrvr.com 2 redirects
2 js.adscale.de cdn-a.yieldlove.com
cdn.stroeerdigitalgroup.de
2 de.ioam.de 1 redirects www.golem.de
2 ad.yieldlab.net cdn-a.yieldlove.com
www.golem.de
2 as-sec.casalemedia.com cdn-a.yieldlove.com
2 adservice.google.ch securepubads.g.doubleclick.net
2 nugmw.userreport.com www.golem.de
2 si.nuggad.net 2 redirects
2 ssl-golem.met.vgwort.de 1 redirects www.golem.de
2 ads.golem.de www.golem.de
1 adstax-match.adrtx.net cdn.adrtx.net
1 cdn.adrtx.net www.golem.de
1 d.agkn.com js.agkn.com
1 cdn.emetriq.de ups.xplosion.de
1 tag.userreport.com sak.userreport.com
1 sak.userreport.com nugmw.userreport.com
1 de-gmtdmp.mookie1.com
1 js.agkn.com cdn.stroeerdigitalgroup.de
1 bbcdn-bbnaut.ibillboard.com cdn.stroeerdigitalgroup.de
1 eus.rubiconproject.com cdn-a.yieldlove.com
1 cdn.districtm.io cdn-a.yieldlove.com
1 ads.pubmatic.com cdn-a.yieldlove.com
1 eu-u.openx.net cdn-a.yieldlove.com
1 acdn.adnxs.com cdn-a.yieldlove.com
1 js-sec.indexww.com cdn-a.yieldlove.com
1 api.yieldlove-ad-serving.net cdn-a.yieldlove.com
1 protected-by.clarium.io www.golem.de
1 42a5e1dcd8b9fdf4787e04106aaf119c.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 clarium.global.ssl.fastly.net confiant-integrations.global.ssl.fastly.net
1 bttrack.com www.golem.de
1 www.storygize.net 1 redirects
1 simage2.pubmatic.com www.golem.de
1 ams.creativecdn.com 1 redirects
1 creativecdn.com 1 redirects
1 bh.contextweb.com 1 redirects
1 pixel.rubiconproject.com 1 redirects
1 match.zorosrv.com
1 match.taboola.com 1 redirects
1 stats.g.doubleclick.net www.golem.de
1 a2a-static.golem.de www.golem.de
1 a2a-cs.golem.de www.golem.de
1 401aed45362298ea2e6087654ef70265.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 cdn.m6r.eu 1 redirects
1 cpx.golem.de www.golem.de
1 account.golem.de www.golem.de
1 www.googletagmanager.com www.golem.de
1 cdn.onthe.io www.golem.de
1 irqs.ioam.de script.ioam.de
1 hbopenbid.pubmatic.com cdn-a.yieldlove.com
1 yieldlove-d.openx.net cdn-a.yieldlove.com
1 orbidder.otto.de cdn-a.yieldlove.com
1 dmx.districtm.io cdn-a.yieldlove.com
1 hb.adscale.de cdn-a.yieldlove.com
1 bidder.criteo.com cdn-a.yieldlove.com
1 mug.criteo.com www.golem.de
1 gum.criteo.com 1 redirects
1 confiant-integrations.global.ssl.fastly.net cdn-a.yieldlove.com
1 adservice.google.com securepubads.g.doubleclick.net
1 s385.mxcdn.net cdn.stroeerdigitalgroup.de
1 s400.mxcdn.net cdn.stroeerdigitalgroup.de
1 cdn-a.yieldlove.com cdn.stroeerdigitalgroup.de
1 script.ioam.de www.golem.de
1 video.golem.de www.golem.de
1 cdn.stroeerdigitalgroup.de www.golem.de
275 106
Subject Issuer Validity Valid
*.golem.de
GeoTrust TLS RSA CA G1		 2019-07-29 -
2020-09-26		 a year crt.sh
cdn.stroeerdigitalgroup.de
DigiCert Secure Site ECC CA-1		 2020-02-13 -
2021-04-13		 a year crt.sh
*.ioam.de
Thawte TLS RSA CA G1		 2019-09-18 -
2021-12-17		 2 years crt.sh
*.met.vgwort.de
Thawte RSA CA 2018		 2020-03-13 -
2022-04-01		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
cdn-a.yieldlove.com
Amazon		 2019-10-02 -
2020-11-02		 a year crt.sh
*.mxcdn.net
DigiCert SHA2 Secure Server CA		 2019-11-04 -
2021-02-02		 a year crt.sh
cat.adscale.de
DigiCert SHA2 Secure Server CA		 2019-07-29 -
2020-10-27		 a year crt.sh
*.userreport.com
RapidSSL RSA CA 2018		 2019-01-10 -
2021-03-10		 2 years crt.sh
*.taboola.com
DigiCert SHA2 Secure Server CA		 2020-06-01 -
2020-09-10		 3 months crt.sh
*.google.ch
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-05-26 -
2020-08-18		 3 months crt.sh
*.freetls.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-04-21 -
2021-04-22		 a year crt.sh
c.amazon-adsystem.com
Amazon		 2019-10-07 -
2020-09-29		 a year crt.sh
*.tracking.v2.yieldlove-ad-serving.net
Amazon		 2019-11-25 -
2020-12-25		 a year crt.sh
*.criteo.com
DigiCert ECC Secure Server CA		 2020-03-30 -
2020-06-28		 3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2020-03-02 -
2021-04-01		 a year crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA		 2019-09-16 -
2021-09-20		 2 years crt.sh
*.adscale.de
Amazon		 2020-06-05 -
2021-07-07		 a year crt.sh
*.yieldlab.net
DigiCert SHA2 Secure Server CA		 2020-02-04 -
2021-05-05		 a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA		 2019-01-23 -
2021-03-08		 2 years crt.sh
districtm.io
CloudFlare Inc ECC CA-2		 2020-02-25 -
2020-10-09		 7 months crt.sh
orbidder.otto.de
Let's Encrypt Authority X3		 2020-05-04 -
2020-08-02		 3 months crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2018-01-04 -
2020-07-09		 3 years crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA		 2019-01-10 -
2021-01-14		 2 years crt.sh
*.smartadserver.com
DigiCert Global CA G2		 2020-02-03 -
2022-02-03		 2 years crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA		 2019-02-22 -
2021-02-21		 2 years crt.sh
*.onthe.io
Sectigo RSA Domain Validation Secure Server CA		 2020-04-07 -
2021-06-06		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-05-20 -
2020-08-12		 3 months crt.sh
sb.scorecardresearch.com
DigiCert Secure Site ECC CA-1		 2020-06-02 -
2021-06-02		 a year crt.sh
meetrics.net
Let's Encrypt Authority X3		 2020-05-26 -
2020-08-24		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2020-05-20 -
2020-08-12		 3 months crt.sh
a2a-cs.golem.de
Let's Encrypt Authority X3		 2020-05-09 -
2020-08-07		 3 months crt.sh
a2a-static.golem.de
Let's Encrypt Authority X3		 2020-06-07 -
2020-09-05		 3 months crt.sh
*.zorosrv.com
DigiCert SHA2 Secure Server CA		 2020-06-07 -
2021-05-19		 a year crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA		 2019-03-19 -
2021-04-13		 2 years crt.sh
*.criteo.net
DigiCert ECC Secure Server CA		 2020-03-30 -
2020-06-28		 3 months crt.sh
*.ad4m.at
AlphaSSL CA - SHA256 - G2		 2017-09-13 -
2020-09-13		 3 years crt.sh
*.ad4mat.net
AlphaSSL CA - SHA256 - G2		 2019-08-06 -
2021-09-08		 2 years crt.sh
protected-by.clarium.io
Gandi Standard SSL CA 2		 2020-04-03 -
2022-04-26		 2 years crt.sh
yieldlove-ad-serving.net
Amazon		 2019-11-19 -
2020-12-19		 a year crt.sh
pipe06.appenzell.net
Let's Encrypt Authority X3		 2020-05-02 -
2020-07-31		 3 months crt.sh
*.fusedeck.net
Amazon		 2020-05-01 -
2021-06-01		 a year crt.sh
cdn.adnxs.com
GlobalSign CloudSSL CA - SHA256 - G3		 2020-04-13 -
2021-04-14		 a year crt.sh
*.theadex.com
GeoTrust RSA CA 2018		 2019-10-11 -
2021-10-10		 2 years crt.sh
*.ibillboard.com
Thawte RSA CA 2018		 2020-04-03 -
2021-07-26		 a year crt.sh
*.xplosion.de
Thawte RSA CA 2018		 2020-01-08 -
2021-03-08		 a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2018-06-21 -
2020-09-16		 2 years crt.sh
*.mookie1.com
DigiCert SHA2 Secure Server CA		 2020-02-21 -
2021-03-22		 a year crt.sh
*.emetriq.de
RapidSSL RSA CA 2018		 2020-02-13 -
2022-04-13		 2 years crt.sh
*.adrtx.net
GeoTrust TLS RSA CA G1		 2018-09-05 -
2020-11-03		 2 years crt.sh

This page contains 34 frames:

Primary Page: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Frame ID: 34DE46E262E270EA32A774F434D2A737
Requests: 165 HTTP requests in this frame

Frame: https://www.golem.de/microsite/abo/minibanner_flat_620.shtml
Frame ID: 8540474E5667815B05E354314933C5B4
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200602/r20190131/zrt_lookup.html
Frame ID: B5360FB3D65308BBF52D05F476C5A21A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2342548244565729&output=html&h=150&slotname=9141079961&adk=3473268664&adf=1229236390&w=1000&lmt=1591908619&rafmt=11&psa=0&guci=1.2.0.0.2.2.0.0&format=1000x150&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&flash=0&wgl=1&adsid=NT&dt=1591908618849&bpp=16&bdt=513&idt=281&shv=r20200602&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=5160217340210&frm=20&pv=2&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&ga_fc=0&iag=0&icsg=3393333577662211&dssz=69&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=300&ady=1793&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=4293903088508887&pem=144&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8336&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6xIoTmpIR3&p=https%3A//www.golem.de&dtd=297
Frame ID: F717989BC385217AFF08DAA0D9FD691D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2342548244565729&output=html&adk=3046330955&adf=2044148826&lmt=1591908619&plat=1%3A32776%2C2%3A32776%2C8%3A32768%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1591908618866&bpp=2&bdt=530&idt=288&shv=r20200602&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1000x150&nras=1&correlator=5160217340210&frm=20&pv=1&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&ga_fc=0&iag=0&icsg=3393333577662211&dssz=70&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=4293903088508887&pem=144&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8208&bc=31&ifi=1&uci=a!1&fsb=1&dtd=293
Frame ID: 61B2A985954A9B07ABBC73CA15AD6F42
Requests: 1 HTTP requests in this frame

Frame: https://ih.adscale.de/map?format=display&ssl=1
Frame ID: D29693E4BF40162C815308149C497194
Requests: 1 HTTP requests in this frame

Frame: https://match.zorosrv.com/match?tabid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&extuid=4e80f856-6b31-4265-87b7-ce4f15d295ca&excid=218&query=taboola_hm%3D4e80f856-6b31-4265-87b7-ce4f15d295ca
Frame ID: 8D3B00CFBF54CFA5D3300DCA045311E4
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunU_8BDnyTuwJZ0H_HIlP4yGFpbdHWfktFJRaf1m_ENetYuG_A_mUQDKifdydMwSuLZDA5jukCM_wuUclut4IxoSq48SNxCgn8nnGA0YTKuHgk8gi2bEBsSg5teohbgcCqbLRGKNybhsW5gGSjMDSctzz_JrrkkaXCS8CFfTPe9kt2cHgEVJ7AUTU-8PWAWh2NPachvdwmKRBwr0RJYpK38sRm2PcGMm1t-2CNM1EkwzG6kjA54RS9KIKXqa_l3mscKYMlfLiTL52p9JbAha3K_1le5BClQolkjtpNd7Tc&sai=AMfl-YTehQj-6Gz6xeXNub75EZA0HYj_y9zvtBerwrqfAXPBCBcboUk_rn6FwTyHRJgfYI3pnY3caaJr8UaHJpop-qyGAYOKA2K3Su8JXgMr&sig=Cg0ArKJSzJZ_HHNJVgNjEAE&urlfix=1&adurl=
Frame ID: 85284541AABA5075EEB527D2BE43E31B
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuajO3gS5OEDVuPPMNbL6VpCgzv4UOsSfrA_BiWOJ3IcFxEJusliKKb844WfdMHyGdciqqojXFD6NW6iBGldT0oKBFqCgT5MnNVOmWUJsRY6Fxbe6yGToxwJmty31k76F-mObmAPk8x4FWMLalr6kKk3gsQAdJNZ9CvD7NNIVyxrSmFnP0Do3Vkc3pkiMHOG_aBQ1A-8prX2mz7kCwgtpStOS-4cDa4E10fe-O4vhfQ88Dh5A7SvXfG5cZnKy8eZ29XfkKEb8-d-oLf8R7nA6Ioyw&sai=AMfl-YTVDGdMOCr_RoqNgSEEULYXZjMsipMD7nUPqzioA2cbqIdwrvqtZ9aI4eqEDKn7GabPmoXLtTGwutSJyVlVGbApTt2PQ8C_BdBih2pS&sig=Cg0ArKJSzMTMMPZbPiC7EAE&urlfix=1&adurl=
Frame ID: A4A57171F5104F351293958141362458
Requests: 18 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTiQkjUhCQhqHIWZzaaCsZFxDhjhS44tE16jbO4FRINup9e4nUMuuCgXK_Q6lVDSV9nbLJUvaEiMlm_zh03ZPmdLNcRPTpkif2CVvOcEAB0UXvNz3DvOhGHwtGXqPsRPyr9rEwK13PYXSbYp0ctg8NrmqtWTtQcS8iXIeNJumwxQVuQ2rG-jPaNj47s_okN3gLChx21uSjWDTsmBLZ5gyUCQP-QE_YdOkY-drDpBTEi1m0etI9RKbakgtb6M0WrBHGQs4UxPUY49_BN0MF7nzxkSNXEO8orvMwzU-5&sai=AMfl-YRRtYZjJ2zCzch7_HZypl3z3TdsWZEcWXWLJjca5MqL8nizLjxxCeAJlli2bq9szUo7vIvh4Ter_kClWX3s7XErvZpvFNI9YM4SdqPW&sig=Cg0ArKJSzNwJ1Uttkh4DEAE&urlfix=1&adurl=
Frame ID: 436D71B3238B455036364314DBE01A0F
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqThlQpUGn0aWFSW1Muq-FbmYNGCqE_OGn_SOQ7Pktskx8Nn3Wx-MFrnlxLjV2m0nhYSJ8PdOCQX_7mB51XM8tatjLxM9Ax9oOTC3hYTgbriKpYuGmQ54PhY689E37-S7J5nvs_O0qKewiYJvqA7IjGG4e8Qbkg-eyGuLI69RrqZ1fEgvCRdpUKSb3dRe64GW9yU_cBrP7cv-U4qGGcGqDC6K6OyNef1NqlkDekc88VcBULalj-oQU2uxYFGPIx8ONZ2OA_2AQpe_5iNQPeQ&sai=AMfl-YTto5emofgQsdw2uTpiZtgQdespIwLX1Xxr6fVxdpphPgxRaQ1k5H06N0Ibi2yweFzzig4jFXs9enj-ME_jf9xXvcHsWBAOloIP19nH&sig=Cg0ArKJSzACk-8WdzkwIEAE&urlfix=1&adurl=
Frame ID: 76CEBBB5235FBA6B6279C99EE86DC42F
Requests: 13 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: F1EDCC7526F160F5CEDDFAC6B1FFF5A7
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: 5055283AD2BF105EB1E812CA2C7A8BD8
Requests: 1 HTTP requests in this frame

Frame: https://ad4mat.net/frame.html
Frame ID: 6C22A0B346A1486C58D041E84F01324C
Requests: 1 HTTP requests in this frame

Frame: https://ad4mat.net/frame.html
Frame ID: 4E4516B79A82E5E3B1AA3336E5C6D3C8
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: BFE40686B9A8BB48AFD303F2389809F1
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/ad/rar?a=14044%2C22451%2C15579&b=oneid6k4aef3fj5WHeHmHYtkt57gumt1T2Voneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2Coneidr3JTQf9fBkRfAH7Hjtqt2zrCwt8TKQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidYz2Srf3f1mbSVH9HetQtWe8aZt1T49oneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&f=oneidXe4czfrfqw7U6H4Het1CxD7U8tkTXQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidPXJaBfbfM5Qa9HjHbtgCR5Kabt9TPboneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidqWGumfWfD34TZHgHDtRC5wxfztgTADoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&c=160&d=600&e=LEnanX71C7guiOJ_StWP1m17DPBMLItg&g=c0f3f0cac9c573b2a23fd736c2e5cb1b%2F9797608355654343780&i=25007%2C25174%2C26474&j=16%2C16%2C41&k=0&l=0&m=0&n=&y=1&z=0
Frame ID: DC2E5EF071DF0F1AE8C1ED7D4A0E2D5F
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/ad/rar?a=14071%2C19490%2C20833&b=oneid7B2sqfzfz6kurHXHgtAtWVbFzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneid7B2sqfzf19ptrHXHgtAtVVZCzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneidp5VS1fgfqYwTkH4HmtztQQBFbtRTEEoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&f=oneidEMzaDfEfAqDFzHAHjt6C34Zt4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidEMzaDfEf8YKszHAHjt6C44bf4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidJVAfzf5fR7ZUBH6H7tqCppGHjtgTbboneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&c=300&d=250&e=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&g=7c9aa75919900f42efc1c61a5aff2113%2F4193698186220969345&i=25091%2C20773%2C20774&j=16%2C14%2C14&k=0&l=0&m=0&n=&y=1&z=0
Frame ID: 36A38E8AD3A727508C3DE5A79F4CC08F
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/2070608/8128330/8128330.js?ADFassetID=8128330&bv=257
Frame ID: 7F198A2CD3E104C351F9162F42A974F8
Requests: 22 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_01.html
Frame ID: 710CB2BF2DD6DE695BC2E5D1608524DB
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_02.html
Frame ID: 900697368434731827640DAB461D2CB3
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_03.html
Frame ID: 178019C8CEF4CD5CBFE87C379769A339
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_04.html
Frame ID: 19385F59A5C3214BA7C5EEFCA6DDB27A
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 2B12AF2882E051D5F5AEB43771FA22B8
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: BB6FD0390C6493B3D3F3B5BBC42622D2
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=2671f27c-3f24-410f-8105-4de0c801f2a9&gdpr=0
Frame ID: 23938F5B82B60B90602DD2B93417A354
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 57ECE7908F35E36EC7B459BC5EB41A96
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 6C9CA6EE7CA9397FD6184A8069336445
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 63DC6EAC8049B08D0742282D31032E17
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: BFF0552544BAD0EC9C556E9DA8994C62
Requests: 1 HTTP requests in this frame

Frame: https://dmp.theadex.com/r/285/5184/?c=4229047847458823986
Frame ID: A2FFB7FA88743E96531763D51CAC55CA
Requests: 1 HTTP requests in this frame

Frame: https://tag.userreport.com/server.html
Frame ID: 897EC5075822791BFF0972D32CC6D030
Requests: 1 HTTP requests in this frame

Frame: https://d.agkn.com/iframe/8613/?che=910636559&gdpr=&gdpr_consent=&ref=&bpid=stroeer&c=%7B%22bpid%22%3A%22stroeer%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Frame ID: C4437ADECDA45BAF58DBAE7535CD4822
Requests: 1 HTTP requests in this frame

Frame: https://adstax-match.adrtx.net/activation?receiverId=adaud
Frame ID: A23E4EF6708C6EB656FC098107E2AAF6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

275
Requests

100 %
HTTPS

25 %
IPv6

61
Domains

106
Subdomains

77
IPs

13
Countries

2363 kB
Transfer

5251 kB
Size

12
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19
  • https://ssl-golem.met.vgwort.de/na/bf4cb38f34634748a4bf43aef52f1885 HTTP 302
  • https://ssl-golem.met.vgwort.de/blank.gif
Request Chain 23
  • https://tracking.m6r.eu/sync/dmp HTTP 302
  • https://tracking.m6r.eu/sync/dmp?checkcookies=true
Request Chain 24
  • https://si.nuggad.net/rc?nuggn=571289945&nuggsid=2088753725&nuggtg=&nuggrid=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html HTTP 302
  • https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=2088753725&nuggtg=&nuggrid=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Request Chain 44
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.golem.de%2F&domain=www.golem.de&cw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=Y5B1SXxkK1dNVDJXb0VqS0kyaDVYNm0wMTBtbk94OTBNL0M0T1VGZjkraUJyazFhc1BYU05aYURONGNLcW4wNXJXdm95ZlZwd0FCU3dFTFVHbGRQdk9FZEpYeFN4TWEzOFJwMUdncnZMaE1OVWMzNzNHRWE4N3Z2R0ZKY1dCWE4wMTIzbktWOC9vQnZmU1lQc3BNSEl2bll4TjVNVVp3R005UXVqOXlldWhKYjF6ZHgrbTVPUCtwQ24xWjdIQ1ZUb3ovL1VpR1FPOVFxQ0s5bFZTV3pyYzZvYW96WTI2VW1JSXBRYXNRdVJ3S3lLUFdjPXw&cppv=2
Request Chain 68
  • https://de.ioam.de/tx.io?st=golem&cp=G_SEC&sv=i2&sc=yes&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.golem.de&xy=1600x1200x24&lo=CH%2FZurich&cb=001d&i2=001dedf140d0d2ebd5ee2990a&ep=1619379949&vr=416&id=b3ypd5&i3=001dedf140d0d2ebd5ee2990a%3A1620766218717%3A1591908618717%3A.golem.de%3A1%3Agolem%3AG_SEC%3Anoevent%3A1591908618717&n1=2&dntt=0&lt=1591908618719&ev=&cs=v4i1uj&mo=1 HTTP 302
  • https://de.ioam.de/tx.io?st=golem&cp=G_SEC&sv=i2&sc=yes&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.golem.de&xy=1600x1200x24&lo=CH%2FZurich&cb=001d&i2=001dedf140d0d2ebd5ee2990a&ep=1619379949&vr=416&id=b3ypd5&i3=001dedf140d0d2ebd5ee2990a%3A1620766218717%3A1591908618717%3A.golem.de%3A1%3Agolem%3AG_SEC%3Anoevent%3A1591908618717&n1=2&dntt=0&lt=1591908618719&ev=&cs=v4i1uj&mo=1&sr=71
Request Chain 89
  • https://cdn.m6r.eu/sync/api HTTP 302
  • https://tracking.m6r.eu/sync/api?checkcookies=true
Request Chain 110
  • https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1591908619119&ns_c=UTF-8&cv=3.5&c8=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&c7=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1591908619119&ns_c=UTF-8&cv=3.5&c8=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&c7=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&c9=&cs_ak_ss=1
Request Chain 114
  • https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=219813472&t=pageview&_s=1&dl=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&ul=en-us&de=UTF-8&dt=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAUAB~&jid=2096983051&gjid=544105129&cid=614140971.1591908619&tid=UA-518800-2&_gid=70199532.1591908619&_r=1&gtm=2ou640&z=873393179 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-518800-2&cid=614140971.1591908619&jid=2096983051&_gid=70199532.1591908619&gjid=544105129&_v=j82&z=873393179
Request Chain 120
  • https://si.nuggad.net/rc?nuggn=571289945&nuggsid=1029839715 HTTP 302
  • https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=1029839715
Request Chain 123
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola HTTP 302
  • https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=4e80f856-6b31-4265-87b7-ce4f15d295ca HTTP 302
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=4e80f856-6b31-4265-87b7-ce4f15d295ca&tbid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&query=taboola_hm%3D4e80f856-6b31-4265-87b7-ce4f15d295ca&isDirect=0 HTTP 302
  • https://match.zorosrv.com/match?tabid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&extuid=4e80f856-6b31-4265-87b7-ce4f15d295ca&excid=218&query=taboola_hm%3D4e80f856-6b31-4265-87b7-ce4f15d295ca
Request Chain 124
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698 HTTP 302
  • https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KBB9AFJO-23-10EI
Request Chain 125
  • https://px.powerlinks.com/user/identify?sourceId=d4a7a706-ab0f-11e8-a038-127202fb7690&rurl=https%3A%2F%2Fam-sync.taboola.com%2Fsg%2Fpowerlinksdsp-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%24%7BUSER%7D&orig=trc HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=113&redir=%2F%2Fpx.powerlinks.com%2Fuser%2Fsync%2Fdsps%3FuserId%3D%5BMM_UUID%5D%26sourceId%3Daa4e7548-789b-4df8-a72f-d951a5b206eb%26sync%3D0%26rurl%3Dhttps%25253A%25252F%25252Fam-sync.taboola.com%25252Fsg%25252Fpowerlinksdsp-network%25252F1%25252Frtb-h%25252F%25253Ftaboola_hm%25253DBUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%2525253D HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=113&redir=%2F%2Fpx.powerlinks.com%2Fuser%2Fsync%2Fdsps%3FuserId%3D%5BMM_UUID%5D%26sourceId%3Daa4e7548-789b-4df8-a72f-d951a5b206eb%26sync%3D0%26rurl%3Dhttps%25253A%25252F%25252Fam-sync.taboola.com%25252Fsg%25252Fpowerlinksdsp-network%25252F1%25252Frtb-h%25252F%25253Ftaboola_hm%25253DBUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%2525253D&mm_bnc&mm_bct&UUID=89cc5ee2-990c-4200-8d86-1363c33a1540 HTTP 302
  • https://px.powerlinks.com/user/sync/dsps?userId=89cc5ee2-990c-4200-8d86-1363c33a1540&sourceId=aa4e7548-789b-4df8-a72f-d951a5b206eb&sync=0&rurl=https%3A%2F%2Fam-sync.taboola.com%2Fsg%2Fpowerlinksdsp-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3DBUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%253D HTTP 302
  • https://am-sync.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=BUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%3D
Request Chain 126
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]&orig=trc HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]&orig=trc&mm_bnc&mm_bct&UUID=3d7b5ee2-990c-4d00-a0e1-6473bac50ade HTTP 302
  • https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=3d7b5ee2-990c-4d00-a0e1-6473bac50ade
Request Chain 127
  • https://bh.contextweb.com/bh/rtset?pid=562107&ev=1&rurl=https%3A%2F%2Fam-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=%%VGUID%%&orig=trc HTTP 302
  • https://am-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=ulJ1mkaxCQHU&ev=1&orig=trc&pid=562107
Request Chain 128
  • https://creativecdn.com/cm-notify?pi=taboola HTTP 302
  • https://ams.creativecdn.com/cm-notify?pi=taboola&tc=1 HTTP 302
  • https://trc.taboola.com/sg/rtbhouse-network/1/rtb-h/?taboola_hm=fdp5qBg0a5ReXaC72psx&pi=taboola&tc=1
Request Chain 129
  • https://b1sync.zemanta.com/usersync/taboola/?puid={user_id}&cb=https://am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/?taboola_hm=__ZUID__&orig=trc HTTP 302
  • https://b1sync.zemanta.com/usersync/taboola/?cb=https%3A%2F%2Fam-sync.taboola.com%2Fsg%2Fzemantartb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__ZUID__&orig=trc&puid=%7Buser_id%7D&s=2 HTTP 302
  • https://am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/?taboola_hm=OpqTkU85aLWjpJbc4WDK
Request Chain 130
  • https://ib.adnxs.com/getuidnb?https://am-sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=$UID&orig=trc HTTP 302
  • https://am-sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
Request Chain 131
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECan4t7dd0UR0KIcupb4AOs&google_cver=1
Request Chain 134
  • https://ib.adnxs.com/getuidnb?https://am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=$UID&orig=trc HTTP 302
  • https://am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
Request Chain 135
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=1eae4e99-6ead-4f5b-aa6f-23e1e01643eb
Request Chain 136
  • https://www.storygize.net/ccm/4b560cdd-91f9-422b-adb7-e9dff26bc3ad?u=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b HTTP 302
  • https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=37cf273d-6031-4a9e-b4c2-17b86d952301
Request Chain 139
  • https://x.bidswitch.net/sync?ssp=taboola HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola HTTP 302
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola HTTP 302
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola&bounced=1 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=9&user_id=eCUZeRFXjsd.AikABlFypSXb7Q&expires=30&ssp=taboola HTTP 302
  • https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=ae07071c-bcbc-4822-8992-151eff285007
Request Chain 194
  • https://ad4m.at/rs?a=&b=38&c=680&d=LEnanX71C7guiOJ_StWP1m17DPBMLItg&e=160&f=600&g=1&h=Stroeer_RON_160x600&i=&j=1065&k=1&l=&m=&n=&o=0&p=0&q=&s=&t=0&r= HTTP 307
  • https://ad4m.at/ad/rar?a=14044%2C22451%2C15579&b=oneid6k4aef3fj5WHeHmHYtkt57gumt1T2Voneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2Coneidr3JTQf9fBkRfAH7Hjtqt2zrCwt8TKQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidYz2Srf3f1mbSVH9HetQtWe8aZt1T49oneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&f=oneidXe4czfrfqw7U6H4Het1CxD7U8tkTXQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidPXJaBfbfM5Qa9HjHbtgCR5Kabt9TPboneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidqWGumfWfD34TZHgHDtRC5wxfztgTADoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&c=160&d=600&e=LEnanX71C7guiOJ_StWP1m17DPBMLItg&g=c0f3f0cac9c573b2a23fd736c2e5cb1b%2F9797608355654343780&i=25007%2C25174%2C26474&j=16%2C16%2C41&k=0&l=0&m=0&n=&y=1&z=0
Request Chain 195
  • https://ad4m.at/rs?a=&b=39&c=680&d=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&e=300&f=250&g=1&h=Stroeer_RON_300x250&i=&j=1065&k=1&l=&m=&n=&o=0&p=0&q=&s=&t=0&r= HTTP 307
  • https://ad4m.at/ad/rar?a=14071%2C19490%2C20833&b=oneid7B2sqfzfz6kurHXHgtAtWVbFzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneid7B2sqfzf19ptrHXHgtAtVVZCzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneidp5VS1fgfqYwTkH4HmtztQQBFbtRTEEoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&f=oneidEMzaDfEfAqDFzHAHjt6C34Zt4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidEMzaDfEf8YKszHAHjt6C44bf4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidJVAfzf5fR7ZUBH6H7tqCppGHjtgTbboneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&c=300&d=250&e=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&g=7c9aa75919900f42efc1c61a5aff2113%2F4193698186220969345&i=25091%2C20773%2C20774&j=16%2C14%2C14&k=0&l=0&m=0&n=&y=1&z=0
Request Chain 211
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_01.png HTTP 301
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_01.png
Request Chain 212
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_02.png HTTP 301
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_02.png
Request Chain 213
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_03.png HTTP 301
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_03.png
Request Chain 214
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_04.png HTTP 301
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_04.png
Request Chain 222
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/bg_muster.png HTTP 301
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/bg_muster.png
Request Chain 241
  • https://ih.adscale.de/adscale-ih/tpui?tpid=48&tpuid=c6b9bef103290bcdf474865cd02fd97c&cburl=https%3A%2F%2Ftracking.m6r.eu%2Fsync%2FadscaleSyncDone%3FuserBuyeruid%3Dc6b9bef103290bcdf474865cd02fd97c%26userId%3Dadscale-user%3A__ADSCALE_USER_ID__ HTTP 302
  • https://ih.adscale.de/adscale-ih/tpui?tpid=48&tpuid=c6b9bef103290bcdf474865cd02fd97c&cburl=https%3A%2F%2Ftracking.m6r.eu%2Fsync%2FadscaleSyncDone%3FuserBuyeruid%3Dc6b9bef103290bcdf474865cd02fd97c%26userId%3Dadscale-user%3A__ADSCALE_USER_ID__&nut&uu=2e626eed1d2044b99fcd893a71e86062 HTTP 307
  • https://tracking.m6r.eu/sync/adscaleSyncDone?userBuyeruid=c6b9bef103290bcdf474865cd02fd97c&userId=adscale-user:a39cc0bb59688e1c529e32fb942f44bc2d161a2e67e787dafce9b543670172b0
Request Chain 242
  • https://tracking.m6r.eu/sync/appnexusRedirect HTTP 302
  • https://ib.adnxs.com/setuid?entity=197&code=c6b9bef103290bcdf474865cd02fd97c HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D197%26code%3Dc6b9bef103290bcdf474865cd02fd97c
Request Chain 243
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xrm-8QMpC830dIZc0C_ZfA HTTP 302
  • https://tracking.m6r.eu/sync/adxSyncDone?google_ula=158217889,0
Request Chain 244
  • https://tracking.m6r.eu/sync/yieldlabRedirect HTTP 302
  • https://ad.yieldlab.net/m?dt_id=36356&ext_id=c6b9bef103290bcdf474865cd02fd97c

275 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
www.golem.de/news/ 		123 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
35024940af9885956183e4ed658cec9865084057cf933bcaecbc44178c3598f5
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains; preload

Request headers

Host
www.golem.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Vary
Accept-Encoding
Set-Cookie
golem_viewauto=desktop%3Agoogle_chrome_83; expires=Fri, 12-Jun-2020 08:50:18 GMT; Max-Age=43200; path=/; domain=.golem.de
Strict-Transport-Security
max-age=15724800; includeSubDomains; preload
X-UPSTREAM
unix:/var/run/php-fpm-www.sock
Content-Encoding
gzip
golem_main_142-min.css
www.golem.de/staticrl/styles/ 		78 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/styles/golem_main_142-min.css
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
694b75cb023360906b37c9b2b4c6d385c307e20eb38b10db06c50d182cb376c6

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jun 2020 13:36:08 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
account_css_rl20_2_0.php
www.golem.de/abo/ 		0
490 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/abo/account_css_rl20_2_0.php
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
X-UPSTREAM
unix:/var/run/php-fpm-www.sock
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Wed, 21 Oct 2015 16:29:00 PDT
gg2_1-0-0-min.css
www.golem.de/staticrl/styles/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/styles/gg2_1-0-0-min.css
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
ff8d0cd9b6e1af7e78d6e1c78d2e71bd6c887ec2f83277305d69f8252f6c26d6

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
golem_main_114-min.js
www.golem.de/staticrl/scripts/ 		100 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/scripts/golem_main_114-min.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
d250260787efed78dd06a1f30ef3503b52ce8271cc22a08b891adaf21eefabc1

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
metaTag.min.js
cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/ 		256 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:10c::5f64:c11b , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
KONICHIWA/1.0 /
Resource Hash
bb7d3ff46bd6e5be407580dd2839028d44e7f2e0da939253ed19dc95d1f17e39

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
3E6C60C757FC12B6
status
200
content-length
60755
x-amz-id-2
3DTEyl2avB5bHtJrqVAqL9wvQXUoMZRxaqNEq5iQ/l5bAWfl4sKhK4wgKUaXcBFZvt6+XnWF57g=
last-modified
Thu, 11 Jun 2020 14:47:09 GMT
server
KONICHIWA/1.0
etag
"827caa1cb1ad7e31b394a8af69490cc1"
access-control-max-age
86400
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=477
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
show_ad.js
www.golem.de/bannertest/iqdigital/dist/ 		26 B
365 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/bannertest/iqdigital/dist/show_ad.js?v02
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
39bb350b848bba90633361b2794bb7557a9059e28b2bd15ca7799ee56610a3d0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 May 2020 09:42:16 GMT
Server
nginx
ETag
"5eb91df8-1a"
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
26
Expires
Sun, 12 Jul 2020 20:50:18 GMT
logo-g.png
www.golem.de/staticrl/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/staticrl/images/logo-g.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
ec3943468e660a13879ad7ea484da73199fd5220d765a1163c045294fbc1c546

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-e82"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
3714
Expires
Sun, 12 Jul 2020 20:50:18 GMT
148302-230219-230218_rc.jpg
www.golem.de/2005/ 		122 KB
123 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/2005/148302-230219-230218_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
f9df5fc31a4260c9623725a19cb9bb108c09648f000d74e1ee48393479faa718

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 06 May 2020 10:10:05 GMT
Server
nginx
ETag
"5eb28cfd-1e9ae"
Content-Type
image/jpeg
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
125358
Expires
Sun, 12 Jul 2020 20:50:18 GMT
gif
cpxl.golem.de/ 		43 B
292 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cpxl.golem.de/gif?u=https%3A%2F%2Fwww.golem.de%2F&d=1591907942&f=ev&v=d&t=ad%2Fjobs2018kw10
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:181 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
/ Express
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
X-Powered-By
Express
Vary
X-HTTP-Method-Override
Content-Type
image/gif
X-RateLimit-Remaining
799
Transfer-Encoding
chunked
X-RateLimit-Limit
800
Connection
keep-alive
gif
cpxl.golem.de/ 		43 B
292 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cpxl.golem.de/gif?u=https%3A%2F%2Fwww.golem.de%2F&d=1591907042&f=ev&v=d&t=ad%2Fdeals2016kw24
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:181 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
/ Express
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
X-Powered-By
Express
Vary
X-HTTP-Method-Override
Content-Type
image/gif
X-RateLimit-Remaining
798
Transfer-Encoding
chunked
X-RateLimit-Limit
800
Connection
keep-alive
s20-snap.jpg
video.golem.de/teaser/1/1/24052/thumb-high-1000/ 		99 KB
99 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://video.golem.de/teaser/1/1/24052/thumb-high-1000/s20-snap.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:175 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
5fa7033ea8a577c5c20da720503495483dae8bb21b708238c34949f637bfe503

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 10 Feb 2020 11:10:51 GMT
Server
nginx
ETag
"5e413a3b-18a73"
Content-Type
image/jpeg
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
100979
Expires
Sun, 12 Jul 2020 20:50:18 GMT
links.png
www.golem.de/_img/gg/ 		195 B
520 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/_img/gg/links.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
9e08d9b8d1eb5cfb13e10bc6afb3a6f3a40f6ac1f65c6ecd076dc66b7edafb6a

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 18 Feb 2009 13:50:45 GMT
Server
nginx
ETag
"499c1235-c3"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
195
Expires
Sun, 12 Jul 2020 20:50:18 GMT
rechts.png
www.golem.de/_img/gg/ 		197 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/_img/gg/rechts.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
55e30adb2faf80e59e4a70a75809a573ed0acd7b6fb703bde722bd3ddf56584d

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 18 Feb 2009 13:50:45 GMT
Server
nginx
ETag
"499c1235-c5"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
197
Expires
Sun, 12 Jul 2020 20:50:18 GMT
minus.png
www.golem.de/_img/gg/ 		404 B
730 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/_img/gg/minus.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
600a0718bc411395294d3af96651470ec26c15c3f0a6ca3b579a523c9098b4ce

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 18 Feb 2009 13:50:44 GMT
Server
nginx
ETag
"499c1234-194"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
404
Expires
Sun, 12 Jul 2020 20:50:18 GMT
icon-ggfs_w2.png
www.golem.de/staticrl/images/ 		274 B
600 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/staticrl/images/icon-ggfs_w2.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
2abfcd790056afc481c48cd6f8e35b79b3bccf309ff6f2c0dfad0650df73d645

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-112"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
274
Expires
Sun, 12 Jul 2020 20:50:18 GMT
golemgallery2_125-min.js
www.golem.de/staticrl/scripts/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/scripts/golemgallery2_125-min.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
96bff9a63428fcafaa40226d7ccf7b90ab5776979db144a62bdef6a7a77d5eec

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
account_js_rl20_1_0.php
www.golem.de/abo/ 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/abo/account_js_rl20_1_0.php
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
e5314e6ef0062ff49bdff5e58cdc00ff10ccb14c1a0a5f2d5265c9149740bbff

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/javascript
X-UPSTREAM
unix:/var/run/php-fpm-www.sock
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Wed, 21 Oct 2015 16:29:00 PDT
sdcv.js
ads.golem.de/ 		63 B
402 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.golem.de/sdcv.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:17a , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
e72acd75e28308144c191955763a907264b850d4e8e2960d724f273e4934e34d

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Tue, 13 May 2014 18:28:31 GMT
Server
nginx
ETag
"5372644f-3f"
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
63
Expires
Sun, 12 Jul 2020 20:50:18 GMT
iam.js
script.ioam.de/ 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.ioam.de/iam.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.215.103.64 , Germany, ASN43407 (INFONLINE-AS, NL),
Reverse DNS
script3.ioam.de
Software
nginx / BLACKBIRD-SRC v0.12 001d
Resource Hash
f295eac03c0b136481b110dfc5502885a4e502986f1a33e7136bf70cee3644e5

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
X-Powered-By
BLACKBIRD-SRC v0.12 001d
Vary
Accept-Encoding
P3P
policyref=https://script.ioam.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Cache-Control
private, max-age=7200, pre-check=7200
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
application/javascript
Expires
Thu, 11 Jun 2020 22:50:18 GMT
blank.gif
ssl-golem.met.vgwort.de/
Redirect Chain
  • https://ssl-golem.met.vgwort.de/na/bf4cb38f34634748a4bf43aef52f1885
  • https://ssl-golem.met.vgwort.de/blank.gif
43 B
332 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl-golem.met.vgwort.de/blank.gif
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
161.156.66.184 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
b8.42.9ca1.ip4.static.sl-reverse.com
Software
s2.51.1 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
s2.51.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Thu, 11 Jun 2020 20:50:18 GMT
Server
s2.51.1
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
Content-Type
text/html
Location
/blank.gif
Cache-Control
max-age=0, no-cache, must-revalidate, proxy-revalidate
Connection
keep-alive
Expires
Tue, 22 Aug 2000 15:05:01 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
sffe /
Resource Hash
7ea414cd6f359d94fc9b789865a45cf671e7b754e4f74c68111229a27210e9e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"540 / 94 of 1000 / last-modified: 1591893560"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14486
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:18 GMT
yieldlove-bidder-stroeer.js
cdn-a.yieldlove.com/ 		375 KB
112 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.87.121 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-121.fra2.r.cloudfront.net
Software
/ Express
Resource Hash
f2987d36cb67fb5016ce89e21ccfe3cb49d7a571c5ff5acf4f421373ec25a047

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 18:20:16 GMT
content-encoding
gzip
age
9002
status
200
x-powered-by
Express
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=10800
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
1wNV-IimNgwrlerzhy1D4kEg_1sy4ERjKXkimwED4XSZ5m89MCNQ-g==
via
1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
mtrcs_679600.js
s400.mxcdn.net/bb-mx/serve/ 		132 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s400.mxcdn.net/bb-mx/serve/mtrcs_679600.js
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.201 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-201.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4843d00895b38e6960ecbce774ae2361a034c47a149088a3865850f90ff319a4

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control
public, max-age=49961
Connection
keep-alive
Content-Type
text/javascript
Content-Length
51688
Expires
Fri, 12 Jun 2020 10:42:59 GMT
dmp
tracking.m6r.eu/sync/
Redirect Chain
  • https://tracking.m6r.eu/sync/dmp
  • https://tracking.m6r.eu/sync/dmp?checkcookies=true
116 B
637 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tracking.m6r.eu/sync/dmp?checkcookies=true
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.56.30.78 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-56-30-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3370a632ca40f137bba450fd14015d5647f443a6724dca1098652503127b0b72

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:20 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.golem.de
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
122

Redirect headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
Server
nginx
Access-Control-Allow-Origin
https://www.golem.de
Content-Type
text/plain; charset=utf-8
Location
https://tracking.m6r.eu/sync/dmp?checkcookies=true
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
72
nuggad
nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/
Redirect Chain
  • https://si.nuggad.net/rc?nuggn=571289945&nuggsid=2088753725&nuggtg=&nuggrid=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
  • https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=2088753725&nuggtg=&nuggrid=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schads...
2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=2088753725&nuggtg=&nuggrid=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:f600:1f:a1b:34c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.14.1 /
Resource Hash
5cf7de40ce05f49081fe1e4271e6cd2eb43fb21aafdd0e69b5078ba9f4d91309

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
via
1.1 21a3da42c823b5a4a2d9c4c63248bbd6.cloudfront.net (CloudFront)
server
nginx/1.14.1
x-amz-cf-pop
FRA2-C2
access-control-allow-methods
get, post, options
content-type
text/javascript
status
200
cache-control
s-maxage=0, max-age=0
access-control-allow-credentials
true
x-cache
Miss from cloudfront
access-control-allow-headers
accept
content-length
1786
x-amz-cf-id
A6PuGRcXt7Iw5ndBlM_yGFKJuUR3KfWNgM9OEFpsZCXS67PxJfJZFw==

Redirect headers

date
Thu, 11 Jun 2020 20:50:18 GMT
via
1.1 9568a708c8ab21597698ebe7dce6c42e.cloudfront.net (CloudFront)
server
nginx/1.14.1
x-amz-cf-pop
FRA2-C1
status
302
access-control-allow-methods
get, post, options
location
https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=2088753725&nuggtg=&nuggrid=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
cache-control
s-maxage=0, max-age=0
access-control-allow-credentials
true
x-cache
Miss from cloudfront
access-control-allow-headers
accept
content-length
0
x-amz-cf-id
QwLWTBRqkA7gheJW2svi2rwn-lkZOZ5i0ucQ_-glSkKM-l8cpZqVrQ==
DroidSans-Bold.woff2
www.golem.de/staticrl/fonts/droidsans/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/fonts/droidsans/DroidSans-Bold.woff2
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
e94712bd5679e91d66469fac2cbf6322a706e4e8f25fe37c762b8167391a7c2c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Origin
https://www.golem.de

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-57f4"
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
22516
Expires
Sun, 12 Jul 2020 20:50:18 GMT
DroidSerif.woff2
www.golem.de/staticrl/fonts/droidserif/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/fonts/droidserif/DroidSerif.woff2
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
334edfbf00ad918aebbf33d4ea9365ce1f41afc3346c9f2ba7edd127d6b30f6c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Origin
https://www.golem.de

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-5870"
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
22640
Expires
Sun, 12 Jul 2020 20:50:18 GMT
DroidSans.woff2
www.golem.de/staticrl/fonts/droidsans/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/fonts/droidsans/DroidSans.woff2
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
d5ea92e80113829e1cc60cb096ac79b4cf7c30c836991667ca7c6605f181bb13

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Origin
https://www.golem.de

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-53c8"
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
21448
Expires
Sun, 12 Jul 2020 20:50:18 GMT
truncated
/ 		335 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
72ce44d1321e5caeec893cabdf662745ce2d8af68b65665b6e62e5f7bbcd5e0f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
minibanner_flat_620.shtml
www.golem.de/microsite/abo/ Frame 8540 		963 B
738 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/microsite/abo/minibanner_flat_620.shtml
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
653ecfa4fbb8a0a5085d4eb14fc668c8cd30ff0b51616f7a8032c88d7468ea93

Request headers

Host
www.golem.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
golem_viewauto=desktop%3Agoogle_chrome_83
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

Server
nginx
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Type
text/html
Last-Modified
Wed, 16 May 2018 15:57:13 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Vary
Accept-Encoding
Content-Encoding
gzip
loader.js
cdn.taboola.com/libtrc/stroeer-golemde/ 		74 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/stroeer-golemde/loader.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
obaker.284.1.1-10.92.4 /
Resource Hash
e3bfdfeab19f423e85d1483297516edc86e2e84f0a5029eb72616991d1959166

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
54ELQbaHbSVlm2q3zW0XMU2r1LSQwvAe
content-encoding
gzip
etag
"b35b104ae82bd474d6f7857ec32ca65ac583b0ca"
age
5072
x-cache
HIT
status
200
content-length
19707
x-amz-id-2
xoX0+Ve9bSkVjGRbkUPEIwVcdHw+XnwBLFxeBO/sWACuiAs5i+tc7t+4DLWQ5x+JIFoTKMU9bEY=
x-served-by
cache-fra19120-FRA
x-from-cache
1
access-control-allow-origin
*
last-modified
Thu, 11 Jun 2020 16:24:23 UTC
server
obaker.284.1.1-10.92.4
x-timer
S1591908619.566960,VS0,VE1
date
Thu, 11 Jun 2020 20:50:18 GMT
vary
Accept-Encoding, Accept-Encoding
x-amz-request-id
2D0BBB8CFE598557
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
19
x-cache-hits
1
btn-follow-sp4b.png
www.golem.de/staticrl/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/staticrl/images/btn-follow-sp4b.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
d79a2c08ec56eb5e1c76ca58af8b280d29c8792641565d3e9983a9ea8f7e9bb6

Request headers

Referer
https://www.golem.de/staticrl/styles/golem_main_142-min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-b0e"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
2830
Expires
Sun, 12 Jul 2020 20:50:18 GMT
truncated
/ 		126 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4e8d6e3b35948e5fb1b6d570acce30f0b1560ed00ec1f300793389f19c967dff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
DroidSerif-Italic.woff2
www.golem.de/staticrl/fonts/droidserif/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/fonts/droidserif/DroidSerif-Italic.woff2
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
33a615b30f0b0648a299b0d7e7f57e6c5a1b52cfcc831b3572c1f6ff77c1e2b1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Origin
https://www.golem.de

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-5074"
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
20596
Expires
Sun, 12 Jul 2020 20:50:18 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		108 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d34da2ea21a041db1e9f4b80b0755ab58036714f03204b9c48dd10fe8e728bec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
39676
x-xss-protection
0
server
cafe
etag
4947602752413276125
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 11 Jun 2020 20:50:18 GMT
golem_csi-133-min.js
www.golem.de/staticrl/scripts/adsense/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/scripts/adsense/golem_csi-133-min.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
b3f72e1980ae38c8289cfccb0d408686a4fef3371ae0c90fbb7139bbe2567f13

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fsky,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fbanner,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Frectangle,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fpost...
s385.mxcdn.net/679600/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://s385.mxcdn.net/679600/%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fsky,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fbanner,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Frectangle,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fposterad,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Frectangle2
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.201 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-201.deploy.static.akamaitechnologies.com
Software
nginx/1.10.3 /
Resource Hash
65bebe1c16bdfa07dbf80ad4a2ba009f24d338eed11f483b4fa618d53d318301

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx/1.10.3
Content-Type
application/json
Access-Control-Allow-Origin
https://www.golem.de
Access-Control-Expose-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Cache-Control
max-age=23052
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1530
Expires
Fri, 12 Jun 2020 03:14:30 GMT
gx-ads.js
ads.golem.de/track.ads/ 		226 B
566 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.golem.de/track.ads/gx-ads.js?ord=7600684469973387&adsize=300x250&adunit=11
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:17a , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
8453ec595b19e74278586279557ad2ed3ff9e76820a6b4c4eaa81072cbd23200

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 04 Feb 2019 16:34:53 GMT
Server
nginx
ETag
"5c5869ad-e2"
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
226
Expires
Sun, 12 Jul 2020 20:50:18 GMT
integrator.js
adservice.google.ch/adsid/ 		109 B
952 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ch/adsid/integrator.js?domain=www.golem.de
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
952 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.golem.de
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
pubads_impl_2020060103.js
securepubads.g.doubleclick.net/gpt/ 		246 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
sffe /
Resource Hash
7281df0fc37f02952ecbff4b9f47640a7f193aac19c97f89e3e276b20d47e454
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Jun 2020 18:46:06 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
90085
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:18 GMT
wrap.js
confiant-integrations.global.ssl.fastly.net/prebid_v3l/202003181643/ 		9 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://confiant-integrations.global.ssl.fastly.net/prebid_v3l/202003181643/wrap.js
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0cdfd11eeff2c617a795c4e0404e2c9fe3a200bf0ea64dbde36737a7046e8a26

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Age
606
X-Cache
HIT
Connection
keep-alive
Content-Length
4026
x-amz-id-2
kCo97gewryJCh+GTOhDcwtkYHasNuC4QIs9wUxO3Z5m5Hfx0Sj7hdElKoOytNTnps2UW7xNXTBw=
X-Served-By
cache-hhn4075-HHN
Last-Modified
Thu, 19 Mar 2020 13:45:42 GMT
Server
AmazonS3
X-Timer
S1591908619.655911,VS0,VE0
ETag
"3fd29b71b30816563db55ec396d140b6"
x-amz-request-id
DDBBC8F87D34C3F9
Via
1.1 varnish
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
1015
apstag.js
c.amazon-adsystem.com/aax2/ 		101 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
Server /
Resource Hash
b388addf9c8ba4bc2852132727bd9df68c99db7ca97d22fdb18ad2a426d02a5b

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:38:29 GMT
content-encoding
gzip
server
Server
age
709
etag
06fa05e9082ab6150f8e415571b3ff6a
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=900
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
syCPI8m57750jJsOjLaj44gLpd0GF5xsFdT3TIULppT_dwPczCmaxA==
via
1.1 59d92388a3a66e5f245f384a437fa025.cloudfront.net (CloudFront)
session
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/session
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:18 GMT
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.golem.de%2F&domain=www.golem.de&cw=1
  • https://mug.criteo.com/sid?cpp=Y5B1SXxkK1dNVDJXb0VqS0kyaDVYNm0wMTBtbk94OTBNL0M0T1VGZjkraUJyazFhc1BYU05aYURONGNLcW4wNXJXdm95ZlZwd0FCU3dFTFVHbGRQdk9FZEpYeFN4TWEzOFJwMUdncnZMaE1OVWMzNzNHRWE4N3Z2R0ZKY1...
393 B
644 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=Y5B1SXxkK1dNVDJXb0VqS0kyaDVYNm0wMTBtbk94OTBNL0M0T1VGZjkraUJyazFhc1BYU05aYURONGNLcW4wNXJXdm95ZlZwd0FCU3dFTFVHbGRQdk9FZEpYeFN4TWEzOFJwMUdncnZMaE1OVWMzNzNHRWE4N3Z2R0ZKY1dCWE4wMTIzbktWOC9vQnZmU1lQc3BNSEl2bll4TjVNVVp3R005UXVqOXlldWhKYjF6ZHgrbTVPUCtwQ24xWjdIQ1ZUb3ovL1VpR1FPOVFxQ0s5bFZTV3pyYzZvYW96WTI2VW1JSXBRYXNRdVJ3S3lLUFdjPXw&cppv=2
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
b1ccfa95f4ea0882054380eeab8fd6bbe71de91ed756d1e63befcda1b6a77427
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Thu, 11 Jun 2020 20:50:19 GMT
status
200
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
393
expires
0

Redirect headers

pragma
no-cache
strict-transport-security
max-age=31536000
status
302
date
Thu, 11 Jun 2020 20:50:18 GMT
location
https://mug.criteo.com/sid?cpp=Y5B1SXxkK1dNVDJXb0VqS0kyaDVYNm0wMTBtbk94OTBNL0M0T1VGZjkraUJyazFhc1BYU05aYURONGNLcW4wNXJXdm95ZlZwd0FCU3dFTFVHbGRQdk9FZEpYeFN4TWEzOFJwMUdncnZMaE1OVWMzNzNHRWE4N3Z2R0ZKY1dCWE4wMTIzbktWOC9vQnZmU1lQc3BNSEl2bll4TjVNVVp3R005UXVqOXlldWhKYjF6ZHgrbTVPUCtwQ24xWjdIQ1ZUb3ovL1VpR1FPOVFxQ0s5bFZTV3pyYzZvYW96WTI2VW1JSXBRYXNRdVJ3S3lLUFdjPXw&cppv=2
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
482
expires
0
cygnus
as-sec.casalemedia.com/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/cygnus?s=335654&v=7.2&r={%22id%22:%22186e50f68e7f54%22,%22imp%22:[{%22id%22:%222e64a68a47bc67%22,%22ext%22:{%22siteID%22:%22335654%22,%22sid%22:%221%22},%22banner%22:{%22w%22:300,%22h%22:250,%22topframe%22:1}},{%22id%22:%223a3dbab86e9f84%22,%22ext%22:{%22siteID%22:%22342742%22,%22sid%22:%222%22},%22banner%22:{%22w%22:300,%22h%22:600,%22topframe%22:1}},{%22id%22:%224c2f3fb0ec4359%22,%22ext%22:{%22siteID%22:%22342742%22,%22sid%22:%222%22},%22banner%22:{%22w%22:160,%22h%22:600,%22topframe%22:1}},{%22id%22:%22527be728d2c254%22,%22ext%22:{%22siteID%22:%22342742%22,%22sid%22:%222%22},%22banner%22:{%22w%22:120,%22h%22:600,%22topframe%22:1}},{%22id%22:%226f24ff62e041a%22,%22ext%22:{%22siteID%22:%22342742%22,%22sid%22:%222%22},%22banner%22:{%22w%22:200,%22h%22:600,%22topframe%22:1}},{%22id%22:%227bc9056d2c3716%22,%22ext%22:{%22siteID%22:%22342742%22,%22sid%22:%222%22},%22banner%22:{%22w%22:301,%22h%22:601,%22topframe%22:1}},{%22id%22:%228a24f17d92120c%22,%22ext%22:{%22siteID%22:%22342744%22,%22sid%22:%223%22},%22banner%22:{%22w%22:300,%22h%22:600,%22topframe%22:1}},{%22id%22:%229b7b75752d0323%22,%22ext%22:{%22siteID%22:%22342744%22,%22sid%22:%223%22},%22banner%22:{%22w%22:300,%22h%22:250,%22topframe%22:1}},{%22id%22:%2210b7777f451e6a3%22,%22ext%22:{%22siteID%22:%22342748%22,%22sid%22:%224%22},%22banner%22:{%22w%22:970,%22h%22:250,%22topframe%22:1}},{%22id%22:%221199f7fd326faad%22,%22ext%22:{%22siteID%22:%22342748%22,%22sid%22:%224%22},%22banner%22:{%22w%22:970,%22h%22:90,%22topframe%22:1}},{%22id%22:%221266740e91e937%22,%22ext%22:{%22siteID%22:%22342748%22,%22sid%22:%224%22},%22banner%22:{%22w%22:800,%22h%22:250,%22topframe%22:1}},{%22id%22:%221324a45db64fa39%22,%22ext%22:{%22siteID%22:%22342748%22,%22sid%22:%224%22},%22banner%22:{%22w%22:728,%22h%22:90,%22topframe%22:1}}],%22site%22:{%22page%22:%22https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22},%22ext%22:{%22source%22:%22prebid%22}}&ac=j&sd=1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.9.98 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-9-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4c3b5063f24797bc9d18e85486e57fca0435821badf7f1086d069328c4df5356

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
1148
Expires
Thu, 11 Jun 2020 20:50:18 GMT
cygnus
as-sec.casalemedia.com/ 		24 B
749 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/cygnus?s=335654&v=8.1&r={%22id%22:%22186e50f68e7f54%22,%22imp%22:[{%22id%22:%222e64a68a47bc67%22,%22ext%22:{%22siteID%22:%22335654%22,%22sid%22:%221%22},%22video%22:{%22w%22:300,%22h%22:250,%22placement%22:4}},{%22id%22:%227bc9056d2c3716%22,%22ext%22:{%22siteID%22:%22342742%22,%22sid%22:%222%22},%22video%22:{%22w%22:301,%22h%22:601,%22placement%22:4}},{%22id%22:%228a24f17d92120c%22,%22ext%22:{%22siteID%22:%22342744%22,%22sid%22:%223%22},%22video%22:{%22w%22:300,%22h%22:600,%22placement%22:4}},{%22id%22:%2210b7777f451e6a3%22,%22ext%22:{%22siteID%22:%22342748%22,%22sid%22:%224%22},%22video%22:{%22w%22:970,%22h%22:250,%22placement%22:4}}],%22site%22:{%22page%22:%22https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22},%22ext%22:{%22source%22:%22prebid%22}}&ac=j&sd=1&nf=1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.9.98 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-9-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
19e152f7eb9ab76c22c7ede546e9e5057142c81d09da3b241dad25f2deb1ca2c

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
44
Expires
Thu, 11 Jun 2020 20:50:18 GMT
cdb
bidder.criteo.com/ 		0
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=29&wv=3.19.0&cb=17514162126
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.am5.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Thu, 11 Jun 2020 20:50:18 GMT
access-control-allow-credentials
true
server
Finatra
access-control-allow-origin
https://www.golem.de
timing-allow-origin
*
vary
Origin
/
adx.adform.net/adx/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/?rp=4&bWlkPTc2NTkxMyZ0cmFuc2FjdGlvbklkPTI0ZWRiOTllLWZkNzQtNDA2OC05YWIwLWIxYzA4MDJkMjg1OQ%3D%3D&bWlkPTcxNDQ0MyZ0cmFuc2FjdGlvbklkPTNlNzdmZWQzLTk2YjUtNGQ0OC05NmExLTllMDg0NTBmOGJiNw%3D%3D&bWlkPTc2NTg1NiZ0cmFuc2FjdGlvbklkPTYyNzliNGM5LWU5NjUtNDc2MC1hZThhLTAyMzQ0OGM2NDcyZg%3D%3D&bWlkPTcxNDQ0NCZ0cmFuc2FjdGlvbklkPTU2Y2M1MzFkLWU1NzItNDg1MS1iNzM2LTZkODVjNjk5MWMwOA%3D%3D&pt=gross&stid=bc22ef17-a81f-4705-93d5-f2bf1d1ab2fa&fd=1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
c0ffbb72a86bc32b7ca6b2960b7b3c736dbef49eaaf13b8a2456e9057e935ead
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
status
200
strict-transport-security
max-age=31536000; includeSubDomains
pragma
no-cache
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET, POST
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
dsh
hb.adscale.de/ 		486 B
503 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.adscale.de/dsh
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.56.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-56-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
161ccad4494446a9539602ccc4ed9fc685ef6da9394d2743033fc0ef095fb503

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
p3p
CP=NOI PSA OUR
status
200
content-type
text/plain
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
x-robots-tag
none
9767285,9767287,9767288
ad.yieldlab.net/yp/ 		2 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ad.yieldlab.net/yp/9767285,9767287,9767288?ts=1591908618660&json=true
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.63.115.52 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-63-115-52.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa OUR IND COM NAV INT"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Language
en-US
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
Content-Length
28
Expires
Wed, 10 Jun 2020 20:50:18 GMT
prebid
ib.adnxs.com/ut/v3/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
3b6010aacc0d5c59c53fce2f1f2c43e62472b75c1add1cbbc40700c9dd339461
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 11 Jun 2020 20:50:20 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
185.236.201.148; 185.236.201.148; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.41:80
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
7889f346-0ef9-4998-bebf-7a5af5838445
Server
nginx/1.13.4
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
dmx.districtm.io/b/ 		0
424 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
server
cloudflare
status
204
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD, POST, OPTIONS
access-control-allow-origin
https://www.golem.de
access-control-allow-credentials
true
cf-ray
5a1e34232b14cc4e-ZRH
access-control-allow-headers
Content-Type, Origin
cf-request-id
0346bee9f70000cc4ef4051200000001
bid
orbidder.otto.de/ 		0
146 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://orbidder.otto.de/bid
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.206.134.202 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
202.134.206.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Thu, 11 Jun 2020 20:50:18 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.golem.de
strict-transport-security
max-age=15724800; includeSubDomains
arj
yieldlove-d.openx.net/w/1.0/ 		8 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://yieldlove-d.openx.net/w/1.0/arj?ju=https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=24edb99e-fd74-4068-9ab0-b1c0802d2859,3e77fed3-96b5-4d48-96a1-9e08450f8bb7,6279b4c9-e965-4760-ae8a-023448c6472f,56cc531d-e572-4851-b736-6d85c6991c08&nocache=1591908618665&aus=300x250|300x600,160x600,120x600,200x600,301x601|300x600,300x250|970x250,970x90,800x250,728x90&divIds=rectangle2,sky,rectangle,banner&auid=540523394,540523392,540523393,540523387
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.188.0 /
Resource Hash
1da2a218d475472681435d7fd54a0d48b33eafbd620677e84947ae8633d57101

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
server
OXGW/16.188.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.golem.de
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
1133
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		241 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16728&site_id=241806&zone_id=1349738&size_id=15&p_pos=btf&rf=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&tk_flint=pbjs_lite_v3.19.0&x_source.tid=24edb99e-fd74-4068-9ab0-b1c0802d2859&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7646544992943751
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
fea36d00c1bc34db2ad3f25f7a85287aa2f41a54e8836280b9291d8c3c62f6d2

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
241
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		237 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16728&site_id=241806&zone_id=1218740&size_id=9&alt_size_ids=8%2C10%2C126&p_pos=atf&rf=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&tk_flint=pbjs_lite_v3.19.0&x_source.tid=3e77fed3-96b5-4d48-96a1-9e08450f8bb7&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.2821946922557539
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
ca22bbea82c56e0ec68b907bd3099e6bd2ee5211d8d3d07a1f6187a86c828fa8

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
237
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		241 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16728&site_id=241806&zone_id=1349732&size_id=15&alt_size_ids=10&p_pos=btf&rf=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&tk_flint=pbjs_lite_v3.19.0&x_source.tid=6279b4c9-e965-4760-ae8a-023448c6472f&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7764881016812917
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
1af86638e13bf09d137304659cfbc7e8ab8140a7dc221147c239a7209cdc39e6

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
241
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		261 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16728&site_id=241806&zone_id=1349674&size_id=2&alt_size_ids=55%2C57%2C125&p_pos=atf&rf=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&tk_flint=pbjs_lite_v3.19.0&x_source.tid=56cc531d-e572-4851-b736-6d85c6991c08&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.10973853754252416
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
492181ed2b52a8c8cf7fae00505cdff03ed15992e697c2176bf60b854a32edd3

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:19 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
v1
prg.smartadserver.com/prebid/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:18 GMT
x-smrt-d
6%3b28%3b57
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
0
expires
-1
v1
prg.smartadserver.com/prebid/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:18 GMT
x-smrt-d
6%3b10%3b101
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
0
expires
-1
v1
prg.smartadserver.com/prebid/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:18 GMT
x-smrt-d
6%3b9%3b66
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-type
application/json
content-length
0
expires
-1
translator
hbopenbid.pubmatic.com/ 		0
114 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Thu, 11 Jun 2020 20:50:18 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://www.golem.de
prebid
ib.adnxs.com/ut/v3/ 		496 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
af9cd3bcdb305980a5809663b5612d222b76988988243f74c8c5e59b34ab83ce
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:20 GMT
X-Proxy-Origin
185.236.201.148; 185.236.201.148; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.133:80
AN-X-Request-Uuid
571fabe9-ff6f-4b42-b729-97ea42ea46d6
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.golem.de
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
496
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
auction
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/auction
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:18 GMT
font-face-1.0.5.css
www.golem.de/staticrl/styles/ Frame 8540 		2 KB
675 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/styles/font-face-1.0.5.css
Requested by
Host: www.golem.de
URL: https://www.golem.de/microsite/abo/minibanner_flat_620.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
2302ce8cf6307e809a07b5cd6ba8a546381a971b75fcc2971090154eea40c4f9

Request headers

Referer
https://www.golem.de/microsite/abo/minibanner_flat_620.shtml
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
minibanner_flat2.css
www.golem.de/microsite/abo/ Frame 8540 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/microsite/abo/minibanner_flat2.css
Requested by
Host: www.golem.de
URL: https://www.golem.de/microsite/abo/minibanner_flat_620.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
14c912652278a80cde809c24f37f3e86754d820ca7c7b2c409af205de7d22d9a

Request headers

Referer
https://www.golem.de/microsite/abo/minibanner_flat_620.shtml
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Aug 2015 17:46:08 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
identitystatus
irqs.ioam.de/ 		25 B
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://irqs.ioam.de/identitystatus?offerIdentifier=golem&siteIdentifier=G_SEC&sampleType=in&pixelType=CP&isFadeoutFlash=true&isFadeoutFrame=true&isFadeoutForm=true&positionTop=10&positionLeft=100&zIndex=1100000&c=0.9401363123536288
Requested by
Host: script.ioam.de
URL: https://script.ioam.de/iam.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.46.63.75 Alfter, Germany, ASN43407 (INFONLINE-AS, NL),
Reverse DNS
irqs.ioam.de
Software
nginx /
Resource Hash
9efa53ec1a261a8576a66a71befaf9d03c1a108aac36271f4599b87597b8a71e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
server
nginx
status
200
vary
Origin
content-type
application/vnd.api+json
access-control-allow-origin
https://www.golem.de
access-control-allow-credentials
true
strict-transport-security
max-age=15768000
tx.io
de.ioam.de/
Redirect Chain
  • https://de.ioam.de/tx.io?st=golem&cp=G_SEC&sv=i2&sc=yes&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.golem.de&xy=1600x1200x24&lo=CH%2FZurich&cb=001d&i2=001dedf140d0d2ebd5ee2990a&ep=1619379949&vr=416&id=b3ypd...
  • https://de.ioam.de/tx.io?st=golem&cp=G_SEC&sv=i2&sc=yes&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.golem.de&xy=1600x1200x24&lo=CH%2FZurich&cb=001d&i2=001dedf140d0d2ebd5ee2990a&ep=1619379949&vr=416&id=b3ypd...
0
717 B 		Script
General
Check archive.org
Download Go to
Full URL
https://de.ioam.de/tx.io?st=golem&cp=G_SEC&sv=i2&sc=yes&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.golem.de&xy=1600x1200x24&lo=CH%2FZurich&cb=001d&i2=001dedf140d0d2ebd5ee2990a&ep=1619379949&vr=416&id=b3ypd5&i3=001dedf140d0d2ebd5ee2990a%3A1620766218717%3A1591908618717%3A.golem.de%3A1%3Agolem%3AG_SEC%3Anoevent%3A1591908618717&n1=2&dntt=0&lt=1591908618719&ev=&cs=v4i1uj&mo=1&sr=71
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.215.103.65 , Germany, ASN43407 (INFONLINE-AS, NL),
Reverse DNS
de3.ioam.de
Software
nginx / BLACKBIRD-RCV v1.06.2 0042
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
X-Powered-By
BLACKBIRD-RCV v1.06.2 0042
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
policyref=https://script.ioam.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/x-javascript
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies

Redirect headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Access-Control-Allow-Origin
*
X-Powered-By
BLACKBIRD-RCV v1.06.2 0042
Transfer-Encoding
chunked
P3P
policyref=https://script.ioam.de/p3p.xml, CP=NOI DSP NID PSAa OUR NOR UNI COM NAV
Connection
keep-alive
Pragma
no-cache
Last-Modified
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html
Location
/tx.io?st=golem&cp=G_SEC&sv=i2&sc=yes&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.golem.de&xy=1600x1200x24&lo=CH%2FZurich&cb=001d&i2=001dedf140d0d2ebd5ee2990a&ep=1619379949&vr=416&id=b3ypd5&i3=001dedf140d0d2ebd5ee2990a%3A1620766218717%3A1591908618717%3A.golem.de%3A1%3Agolem%3AG_SEC%3Anoevent%3A1591908618717&n1=2&dntt=0&lt=1591908618719&ev=&cs=v4i1uj&mo=1&sr=71
Cache-Control
no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookies
Expires
Tue, 11 Jun 2019 20:50:18 GMT
IjvnOpbzskTW
cdn.onthe.io/io.js/ 		70 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onthe.io/io.js/IjvnOpbzskTW
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.93.100.57 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
4d3e1c71d302c1ea7865ebc3d2751eb37c1a32aa0878bd6503cfde624b54c7a9

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Fri, 13 Mar 2020 11:07:37 GMT
Server
nginx
ETag
W/"5e6b6979-11664"
Transfer-Encoding
chunked
Content-Type
text/javascript
Cache-Control
max-age=86400
Connection
keep-alive
Expires
Fri, 12 Jun 2020 20:50:18 GMT
js
www.googletagmanager.com/gtag/ 		83 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-518800-2
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
14a18f72aaee0adaa4dd6f84980b3b6dc8e37988bad2d2b942fa8139d26bb68a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33215
x-xss-protection
0
last-modified
Thu, 11 Jun 2020 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 11 Jun 2020 20:50:18 GMT
ping
account.golem.de/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://account.golem.de/ping?callback=jQuery22403516186890696822_1591908618418&_=1591908618419
Requested by
Host: www.golem.de
URL: https://www.golem.de/staticrl/scripts/golem_main_114-min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:180 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Cache-Control
private, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
-1
golem_cpxl_113-min.js
www.golem.de/staticrl/scripts/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/scripts/golem_cpxl_113-min.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
42bb877744c06037d98b964f68c3e5d4794968c0915fef531db5137a39b3b0c5

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
Expires
Sun, 12 Jul 2020 20:50:18 GMT
sp_148909-233551-233549_rc.jpg
www.golem.de/2006/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/2006/sp_148909-233551-233549_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
b70f178dcf05ca92cc0a2fda1482495e278dc6e1cde3b5e656d46bfe935df2ab

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 10 Jun 2020 05:54:04 GMT
Server
nginx
ETag
"5ee0757c-3dec"
Content-Type
image/jpeg
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
15852
Expires
Sun, 12 Jul 2020 20:50:18 GMT
sp_148823-232755-232753_rc.jpg
www.golem.de/2005/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/2005/sp_148823-232755-232753_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
34be5162c1722c179608dbc8914407223f7e908d887eb8bc0885cc30f2e45108

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Sun, 31 May 2020 08:18:04 GMT
Server
nginx
ETag
"5ed3683c-5486"
Content-Type
image/jpeg
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
21638
Expires
Sun, 12 Jul 2020 20:50:18 GMT
sp_148879-233011-233009_rc.jpg
www.golem.de/2006/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/2006/sp_148879-233011-233009_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
a3ee3dfa0c841ac65f9474ec69cc305561ff88e2719fe9d9032b088ba3f1ce93

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 03 Jun 2020 12:00:05 GMT
Server
nginx
ETag
"5ed790c5-64b1"
Content-Type
image/jpeg
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
25777
Expires
Sun, 12 Jul 2020 20:50:18 GMT
cpx.php
cpx.golem.de/ 		42 B
420 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cpx.golem.de/cpx.php?class=1&aid=148302&page=1&ts=1591908619&ref=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:182 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
Apache /
Resource Hash
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Thu, 11 Jun 2020 20:50:18 GMT
Server
Apache
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
P3P
CP="NOI NID ADMa OUR IND UNI COM NAV"
X-Cnection
close
Content-Type
image/gif
Content-Length
42
Expires
Sat, 10 Oct 2000 03:33:33 GMT
amain.css.php
www.golem.de/staticrl/styles/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/styles/amain.css.php
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
483a037c1a64d12b012a708b4c5b88f00991843b190c45cec9824cb6299f1d1c

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
X-UPSTREAM
unix:/var/run/php-fpm-www.sock
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
amain.js.php
www.golem.de/staticrl/scripts/ 		45 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/scripts/amain.js.php
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
213e1412ca50f1c23ce37f3458999f8b6b7564867795096fc03a214906c400ff

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript
X-UPSTREAM
unix:/var/run/php-fpm-www.sock
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=3
impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
cdn.taboola.com/libtrc/ 		448 KB
127 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/stroeer-golemde/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
71a2d7ee39a1512010d2ae4af01fc763eb460217497aafe78338d4e2818025b8

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
HZOwmttt0Sow8Ef2fLCQW4waz9HSPfQ5
content-encoding
gzip
etag
"4afabcb3d5fa05db1e4a5aaba44f26a3"
age
18
x-cache
HIT
status
200
x-amz-replication-status
FAILED
content-length
129658
x-amz-id-2
jI0FchSdmxXgt2th1J8lfTXa2457HJ+gpNhOsgEyqQMm1F4XuE0URcZCnyKw+zUzr1lC7/Ougo8=
x-served-by
cache-fra19120-FRA
x-amz-expiration
expiry-date="Sun, 05 Jul 2020 00:00:00 GMT", rule-id="expire-versioned-static"
last-modified
Thu, 04 Jun 2020 15:21:32 GMT
server
AmazonS3
x-timer
S1591908619.795864,VS0,VE0
date
Thu, 11 Jun 2020 20:50:18 GMT
vary
Accept-Encoding
x-amz-request-id
37E5152E665AE8D9
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
35
x-cache-hits
8
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/stroeer-golemde/loader.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.96.130.160 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-130-160.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
884
Expires
Fri, 12 Jun 2020 20:50:18 GMT
tr5
cdn.taboola.com/libtrc/ 		3 B
78 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/tr5?abgroup=block_fast_clicks_2_varC
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
via
1.1 varnish
server
Varnish
x-timer
S1591908619.795873,VS0,VE0
x-served-by
cache-fra19120-FRA
x-cache
HIT
content-type
text/html
status
200
cache-control
private,max-age=14400
accept-ranges
bytes
content-length
3
retry-after
0
x-cache-hits
0
display-mit-werbung5.png
www.golem.de/microsite/abo/img/ Frame 8540 		984 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/microsite/abo/img/display-mit-werbung5.png
Requested by
Host: s400.mxcdn.net
URL: https://s400.mxcdn.net/bb-mx/serve/mtrcs_679600.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
a5bca980db62cd62b8af6d7e13a8fca10bcf3275d804a266bac4cd2907e206d2

Request headers

Referer
https://www.golem.de/microsite/abo/minibanner_flat2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 12 Aug 2015 17:41:58 GMT
Server
nginx
ETag
"55cb8566-3d8"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
984
Expires
Sun, 12 Jul 2020 20:50:18 GMT
display-ohne-werbung5.png
www.golem.de/microsite/abo/img/ Frame 8540 		875 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/microsite/abo/img/display-ohne-werbung5.png
Requested by
Host: s400.mxcdn.net
URL: https://s400.mxcdn.net/bb-mx/serve/mtrcs_679600.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
71561a3bca82f8abb1c48231b9d1a6500aa76c5f3eb838f2ac1dc0c81c5811ae

Request headers

Referer
https://www.golem.de/microsite/abo/minibanner_flat2.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Wed, 12 Aug 2015 17:41:59 GMT
Server
nginx
ETag
"55cb8567-36b"
Content-Type
image/png
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
875
Expires
Sun, 12 Jul 2020 20:50:18 GMT
DroidSans-Bold.woff2
www.golem.de/staticrl/fonts/droidsans/ Frame 8540 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/fonts/droidsans/DroidSans-Bold.woff2
Requested by
Host: s400.mxcdn.net
URL: https://s400.mxcdn.net/bb-mx/serve/mtrcs_679600.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
e94712bd5679e91d66469fac2cbf6322a706e4e8f25fe37c762b8167391a7c2c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/staticrl/styles/font-face-1.0.5.css
Origin
https://www.golem.de

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-57f4"
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
22516
Expires
Sun, 12 Jul 2020 20:50:18 GMT
DroidSans.woff2
www.golem.de/staticrl/fonts/droidsans/ Frame 8540 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.golem.de/staticrl/fonts/droidsans/DroidSans.woff2
Requested by
Host: s400.mxcdn.net
URL: https://s400.mxcdn.net/bb-mx/serve/mtrcs_679600.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
d5ea92e80113829e1cc60cb096ac79b4cf7c30c836991667ca7c6605f181bb13

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/staticrl/styles/font-face-1.0.5.css
Origin
https://www.golem.de

Response headers

Date
Thu, 11 Jun 2020 20:50:18 GMT
Last-Modified
Mon, 11 Nov 2019 17:08:48 GMT
Server
nginx
ETag
"5dc995a0-53c8"
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
21448
Expires
Sun, 12 Jul 2020 20:50:18 GMT
submit
lb52.s400.meetrics.net/bb-mx/ 		43 B
291 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/bb-mx/submit?/5yiMBhAAA/whFsBo0F0wFz6BvvA33F3uBnvFslFtuBklFvuEl3FzvByhFuzFvtF3hFylFtzEjoFhkFzvFm0F3hFylFtiEllFpuF0yFhlFjoF0pFn0FtwEyvFk1Fr0FpvFutBilFptBmyFlzFluFp1FztBywAw1AtxA04AzwAyuAo0FtsFfpyF+k2FoywAywAtwA0tAw5AtxAw6AzxAt2A35A2wAwtAyuAxxA3uAytA4lE20Ai1B2wAL2wFBLl1FC/2xFfDylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFg3EpuFkvF3fF3lFirFp0FjhFujFlsFhuFptFh0FpvFumFyhFtlFg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FmpFslFz5Fz0FltFg3EpuFkvF3fF3lFirFp0FylFzvFs2FlsFvjFhsFmpFslFz5Fz0FltF1yFsgBjzFzfF3lFirFp0FgjEw1FfxB2gAyhFtfF4BEOprFw6lCOqwFw6lClqwF23A52AwwALkmFBTkzFsFAAAAAAAZwSzEBPAAAAAAAAAOAAAAGJAAAAAAZwSzEBBRksFAQtjFjWjbTA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Thu, 11 Jun 2020 20:50:17 GMT
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMCjAAATkzFARksFAQtjFAwJNSA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:18 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:17 GMT
nuggad
ih.adscale.de/ 		49 B
278 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ih.adscale.de/nuggad?/nvars/d7=1&d10=5&d4=6&d11=0&d8=2&d9=2&d12=1&d1=1&d3=5
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.42.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-42-46.eu-central-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 11 Jun 2020 20:50:19 GMT
server
Apache-Coyote/1.1
content-type
image/gif
content-length
49
p3p
CP=NOI PSA OUR
api
tracking.m6r.eu/sync/
Redirect Chain
  • https://cdn.m6r.eu/sync/api
  • https://tracking.m6r.eu/sync/api?checkcookies=true
1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.m6r.eu/sync/api?checkcookies=true
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.56.30.78 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-56-30-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
12eab7ed9516d8d3da05af9f6af5f31f280da236929d76b0a135cf7cce47ea82

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:22 GMT
Content-Encoding
gzip
Last-Modified
Thu, 04 Jun 2020 10:57:22 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
654

Redirect headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
Server
nginx
Vary
Accept
Content-Type
text/plain; charset=utf-8
Location
https://tracking.m6r.eu/sync/api?checkcookies=true
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
72
Expires
Thu, 11 Jun 2020 20:50:21 GMT
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/ 		215 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c0563e7f92c3564af0f9d4cfbce95ed0f34c6e7e0b4c04dd68e4b6628412c458
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
82827
x-xss-protection
0
server
cafe
etag
4187836308712077645
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Jun 2020 20:50:18 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200602/r20190131/ Frame B536 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20200602/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20200602/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Tue, 09 Jun 2020 21:38:23 GMT
expires
Tue, 23 Jun 2020 21:38:23 GMT
content-type
text/html; charset=UTF-8
etag
17826495148367054107
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4284
x-xss-protection
0
cache-control
public, max-age=1209600
age
169915
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
ads
securepubads.g.doubleclick.net/gampad/ 		431 B
735 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4293903088508887&correlator=3158875519095200&output=ldjh&impl=fifs&adsid=NT&eid=21066031%2C21064170&vrg=2020060103&guci=2.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200611&iu_parts=4444%2Cdisp_ctc_golem.de_sd%2Cartikel&enc_prev_ius=0%2F1%2F2&prev_iu_szs=800x450%7C580x500%7C580x360%7C480x360%7C42x31&prev_scp=as%3Dposterad%26adslot%3Dposterad%26pc%3D1%26mtrcskv%3D100-1_75%2C50-1_75%2C50-1_100%2C60-1_100%2C65-1_75%2C70-1_75%2C80-1_75%26af%3Dptad%2Cintxspt&cust_params=tagm%3Dmt%26browserapp%3Dchrome%26viewportWidth%3D1581-1680%26viewportHeight%3D1153-1200%26tagtype%3Dsra%26yt%3D0%26adset%3Dbrsl%26nuggad%3Dn127-0%252Cn121-2%252Cn116-0%252Cn104-1%252Cn15-1%252Cn155-1%252Cn106-1%252Cn52-1%252Cn153-1%252Cn11-1%252Cn120-2%252Cn154-1%252Cn125-0%252Cn8-5%252Cn137-0%252Cn101-1%252Cn108-0%252Cn54-0%252Cn110-0%252Cn87-0%252Cn149-0%252Cn76-1%252Cn66-1%252Cn60-1%252Cn139-1%252Cn160-1%252Cn107-1%252Cn21-1%252Cn40-1%252Cn117-2%252Cn86-0%252Cn147-4%252Cn64-0%252Cn119-5%252Cn18-1%252Cn161-1%252Cn126-1%252Cn92-2%252Cn62-1%252Cn57-1%252Cn77-0%252Cn83-0%252Cn102-0%252Cn105-0%252Cn159-1%252Cn20-1%252Cn80-0%252Cn12-6%252Cn141-0%252Cn157-1%252Cn99-1%252Cn128-1%252Cn118-6%252Cn85-1%252Cn9-0%252Cn6-2%252Cn63-0%252Cn58-1%252Cn38-2%252Cn138-0%252Cn140-0%252Cn94-2%252Cn111-0%252Cn136-0%252Cn79-1%252Cn93-3%252Cn90-1%252Cn142-0%252Cn7-2%252Cn103-0%252Cn158-1%252Cn124-1%252Cn75-0%252Cn91-0%252Cn46-1%252Cn114-1%252Cn69-0%252Cn10-1%252Cn3-1%252Cn82-1%252Cn84-1%252Cn5-5%252Cn109-0%252Cn122-1%252Cn67-0%252Cn115-1%252Cn89-2%252Cn123-2%252Cn17-1%252Cn78-1%252Cn81-1%252Cn88-0%252Cn39-1%252Cn156-1%252Cn148-0%26keywords%3Dsec%252Cwirtschaft%252Capps%252Callesaussercorona%252Cantivirus%252Cdatensicherheit%252Cransomware%252Ctsilkcalb%252Citsicherheit%252Cmalware%252Cmedizin%252Ctrojaner%252Cvirus%252Cautorhannoboeck%252Cinternetsecurity%252Cdesktopapplikationen%252Csecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1591908618&dt=1591908618899&dlt=1591908618337&idt=539&frm=20&biw=1600&bih=1200&oid=3&adxs=400&adys=1709&adks=902504611&ucis=1&ifi=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&dssz=66&icsg=62535428488963&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x450&msz=1000x450&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&fws=0&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
3c555769a517ffa3db992c9924e9512eb1c5163d7017bcea42660f9c38bcc0bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
236
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
401aed45362298ea2e6087654ef70265.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://401aed45362298ea2e6087654ef70265.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 06:54:20 GMT
via
1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
vary
Accept-Encoding,Origin
age
50160
x-cache
Hit from cloudfront
status
200
content-length
6482
last-modified
Sat, 06 Jun 2020 15:26:41 GMT
server
AmazonS3
etag
"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
x-amz-cf-id
0IK2v-FzVDhXov2RbhP8XnQVTymqFtNfQ5lyGEek8oUCe0P-JIWDkg==
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
368 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=3505&u=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&pid=EQGhcdnR7ZSKA&cb=0&ws=1600x1200&v=7.50.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x600%22%2C%22160x600%22%2C%22120x600%22%2C%22200x600%22%2C%22301x601%22%5D%2C%22sn%22%3A%22%2F3505%2Fgolem.de_d_300x600_1%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22800x250%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F3505%2Fgolem.de_d_970x250_1%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F3505%2Fgolem.de_d_300x600_2%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F3505%2Fgolem.de_d_300x250_2%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-199-29.fra2.r.cloudfront.net
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
via
1.1 59d92388a3a66e5f245f384a437fa025.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA2-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.golem.de
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
Hk-rtmWM91etiC8YwA9O3d2kL3gv-1r-tTbVZ1LjdP_mmWzFqZw5gQ==
json
cpxl.golem.de/ 		0
474 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cpxl.golem.de/json
Requested by
Host: www.golem.de
URL: https://www.golem.de/staticrl/scripts/golem_main_114-min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:181 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
X-RateLimit-Limit
800
X-Powered-By
Express
Vary
X-HTTP-Method-Override
Access-Control-Allow-Methods
POST, OPTIONS
Access-Control-Allow-Origin
https://www.golem.de
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
X-RateLimit-Remaining
797
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
ETag
W/"a-oQDOV50e1MN2H/N8GYi+8w"
json
cpxl.golem.de/ 		0
474 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cpxl.golem.de/json
Requested by
Host: www.golem.de
URL: https://www.golem.de/staticrl/scripts/golem_main_114-min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:181 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
X-RateLimit-Limit
800
X-Powered-By
Express
Vary
X-HTTP-Method-Override
Access-Control-Allow-Methods
POST, OPTIONS
Access-Control-Allow-Origin
https://www.golem.de
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
X-RateLimit-Remaining
796
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
ETag
W/"a-oQDOV50e1MN2H/N8GYi+8w"
userconnect.js
js.adscale.de/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adscale.de/userconnect.js
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.63.149.97 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-63-149-97.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
b421ca0ae38a2c2c3a630a82e36565f7781a9d2c274000d21c2d8e20c1ac660c

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
sEW8X4cfVjbJM.BHiHWcil16Yai1kJaL
Content-Encoding
gzip
Last-Modified
Tue, 09 Jun 2020 02:05:04 GMT
Server
AmazonS3
x-amz-request-id
1478A0D42A5371C7
ETag
"fadb2110cca53df642b543ccc4af0172"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=300
Date
Thu, 11 Jun 2020 20:50:19 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4701
x-amz-id-2
JS86NNmByJHsaEPmBpsd2OjnZqb74rxU70k+eknDPY7xXwTe5ytqezdl8AL6rQ8DZRNwXZamfOY=
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-518800-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 30 Apr 2020 21:54:13 GMT
server
Golfe2
age
640
date
Thu, 11 Jun 2020 20:39:38 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18433
expires
Thu, 11 Jun 2020 22:39:38 GMT
get
a2a-cs.golem.de/v1/company/ 		561 B
908 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a2a-cs.golem.de/v1/company/get
Requested by
Host: www.golem.de
URL: https://www.golem.de/staticrl/scripts/amain.js.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.74.59.146 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
a2a-admin.golem.de
Software
nginx /
Resource Hash
588875574017ece47aada065ca4c0e4d17a99ebd085cc11b4350493e55e215a4

Request headers

Authorization
64c100a3-7a67-4ff5-7f4a-e3989b3d7712:
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
Server
nginx
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Pagination-Prev-Page,X-Pagination-Next-Page,X-Pagination-Per-Page
X-UPSTREAM
10.0.43.35:2006
Connection
keep-alive
Keep-Alive
timeout=5
Content-Length
561
a2a_Logo.svg
a2a-static.golem.de/assets/ 		742 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a2a-static.golem.de/assets/a2a_Logo.svg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
176.74.59.146 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
a2a-admin.golem.de
Software
nginx /
Resource Hash
039aeb8071cbb8114596777717fee193d820b342a43343bf4dfb365c3ccc1e3d

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
Last-Modified
Wed, 20 May 2020 09:04:57 GMT
Server
nginx
ETag
"5ec4f2b9-2e6"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*.golem.de
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
742
/
tt.onthe.io/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/?k[]=43098:uniques_instantly[domain:www.golem.de,url:%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html,page:Ransomware%3A%20Schadsoftware%20beeintr%26auml%3Bchtigt%20Produktion%20bei%20Fresenius,author:No%20Author,language:de,site_skin:desktop,custom_page_type:Article%20page,article_layout:default,category:news,type_article:shortread,pub_date:6%20May%202020%2012%3A09%3A00%20CEST,reference_time:72,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36,device:desktop,browser_version:Other%2083,browser:Other,depth:1,user_type:new,user_id:0dd343421.729be1b2c_1591908619011,session_id:b1f65f9d7.d2e406231_1591908619014,cdn_version:9]&s=6acc7c777cce3be138a245218c439c54&1591908619020
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:19 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/uniques/ 		33 B
559 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/uniques/?current=11&holding=108810e7aaccba71ff5759d480adc9d0&hash_user=0dd343421.729be1b2c_1591908619011&1591908619021
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
166f9390df29e23f9c9c45c50026de3b8ea04605424c6edc8557a3d3e71af7b8

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:22 GMT
Server
nginx
Content-Type
text/html
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
33
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/?k[]=43098:visits_instantly[domain:www.golem.de,url:%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html,page:Ransomware%3A%20Schadsoftware%20beeintr%26auml%3Bchtigt%20Produktion%20bei%20Fresenius,author:No%20Author,language:de,site_skin:desktop,custom_page_type:Article%20page,article_layout:default,category:news,type_article:shortread,pub_date:6%20May%202020%2012%3A09%3A00%20CEST,reference_time:72,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36,device:desktop,browser_version:Other%2083,browser:Other,depth:1,user_type:new,user_id:0dd343421.729be1b2c_1591908619011,session_id:b1f65f9d7.d2e406231_1591908619014,cdn_version:9]&s=6acc7c777cce3be138a245218c439c54&__io=0dd343421.729be1b2c_1591908619011&1591908619026
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:19 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
/
tt.onthe.io/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/?k[]=43098:pageviews[domain:www.golem.de,url:%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html,page:Ransomware%3A%20Schadsoftware%20beeintr%26auml%3Bchtigt%20Produktion%20bei%20Fresenius,author:No%20Author,language:de,site_skin:desktop,custom_page_type:Article%20page,article_layout:default,category:news,type_article:shortread,pub_date:6%20May%202020%2012%3A09%3A00%20CEST,reference_time:72,user_agent:Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36,device:desktop,browser_version:Other%2083,browser:Other,depth:1,user_type:new,user_id:0dd343421.729be1b2c_1591908619011,session_id:b1f65f9d7.d2e406231_1591908619014,cdn_version:9]&s=6acc7c777cce3be138a245218c439c54&1591908619030
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:19 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
json
trc.taboola.com/stroeer-golemde/trc/3/ 		12 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/stroeer-golemde/trc/3/json?tim=22%3A50%3A19.071&lti=block_fast_clicks_2_varC&data=%7B%22id%22%3A319%2C%22ii%22%3A%22%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1591908619064%2C%22cv%22%3A%2220200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22pev%22%3A3025%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A4404%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A1781.75%2C%22mw%22%3A1000%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22block_fast_clicks_2_varC%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
2cfcaead3ad0e286c0e874d373b8d05ae70c957ee7f21d83548097f4d941df48

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
197
date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
access-control-allow-origin
*
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
x-served-by
cache-hhn4047-HHN
server
nginx
x-timer
S1591908619.368272,VS0,VE197
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
ads
securepubads.g.doubleclick.net/gampad/ 		41 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4293903088508887&correlator=3158875519095200&output=ldjh&impl=fifs&adsid=NT&eid=21066031%2C21064170&vrg=2020060103&guci=2.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200611&iu_parts=4444%2Cdisp_ctc_golem.de_sd%2Cartikel&enc_prev_ius=0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2&prev_iu_szs=10x40%7C10x30%7C10x20%7C500x600%7C120x600%7C160x600%7C200x600%7C300x600%7C770x200%7C33x31%2C20x10%7C30x10%7C40x10%7C80x10%7C848x90%7C968x90%7C770x250%7C800x250%7C970x250%7C1100x250%7C728x90%7C728x180%7C1280x250%7C1000x250%7C31x31%2C10x20%7C10x10%7C300x250%7C300x125%7C34x31%2C10x10%7C301x250%7C300x126%7C34x32&prev_scp=as%3Dsky%26adslot%3Dsky%26af%3Dfirepl%2Cwp%2Cvidwa%2Cbri%2Cbrbo%2Cf1x4%2Cf1x3%2Cf1x2%2Cds%2Cdds%2Csky%2Chpad%2Cband%26rfree%3D200-299%26pc%3D1%26mtrcskv%3D100-1_75%2C50-1_75%2C50-1_100%2C60-1_100%2C65-1_75%2C70-1_75%2C80-1_75%26yieldlove_reload%3Dpid%253A17298.reload%253Afalse%26yieldlove_meta_reload%3Dpid%253A17298.reload%253Afalse%26yieldlove_reloads%3D0%26yieldlove_reload_count%3D0%26yieldlove_ab%3Dpo%253Adefault%26yieldlove_meta_ab%3Dpid%253A17298.po%253Adefault%26yieldlove_meta%3Dpid%253A17298.sb%253Af%26yieldlove_pid%3D17298%26yieldlove_hb_sucbid%3Dfalse%26hb_unit%3Dsky%26yieldlove_reloaded%3Dfalse%26yieldlove_is_reloaded%3Dfalse%7Cas%3Dbanner%26adslot%3Dbanner%26af%3Dds%2Cbri%2Cdds%2Cf2x1%2Cf3x1%2Cf4x1%2Cf8x1%2Cwp%2Cfirepl%2Cbb%2Cstbb%2Cleadb%2Cdleadb%2Cvidwa%2Cbrbo%2Cffa%2Cfla%2Cvto%26pc%3D1%26mtrcskv%3D100-1_75%2C50-1_75%2C50-1_100%2C60-1_100%2C65-1_75%2C70-1_75%2C80-1_75%26yieldlove_reload%3Dpid%253A17295.reload%253Afalse%26yieldlove_meta_reload%3Dpid%253A17295.reload%253Afalse%26yieldlove_reloads%3D0%26yieldlove_reload_count%3D0%26yieldlove_ab%3Dpo%253Adefault%26yieldlove_meta_ab%3Dpid%253A17295.po%253Adefault%26yieldlove_meta%3Dpid%253A17295.sb%253At.pr%253At%26yieldlove_pid%3D17295%26yieldlove_hb_sucbid%3Dtrue%26hb_unit%3Dbanner%26yieldlove_hb_size%3D970x250%26hb_bidder%3Dadform%26hb_pb%3D0.90%26hb_adid%3D67193641121bd06%26yieldlove_hb_prime%3Dtrue%26yieldlove_hb_cpm%3D0.90%26yieldlove_reloaded%3Dnever%26yieldlove_is_reloaded%3Dnever%7Cas%3Drectangle%26adslot%3Drectangle%26pc%3D1%26mtrcskv%3D100-1_75%2C50-1_75%2C50-1_100%2C60-1_100%2C65-1_75%2C70-1_75%2C80-1_75%26yieldlove_reload%3Dpid%253A17299.reload%253Afalse%26yieldlove_meta_reload%3Dpid%253A17299.reload%253Afalse%26yieldlove_reloads%3D0%26yieldlove_reload_count%3D0%26yieldlove_ab%3Dpo%253Adefault%26yieldlove_meta_ab%3Dpid%253A17299.po%253Adefault%26yieldlove_meta%3Dpid%253A17299.sb%253Af%26yieldlove_pid%3D17299%26yieldlove_hb_sucbid%3Dfalse%26hb_unit%3Drectangle%26yieldlove_reloaded%3Dnever%26yieldlove_is_reloaded%3Dnever%26af%3Df1x2%2Cf1x1%2Cmrec%7Cas%3Drectangle2%26adslot%3Drectangle2%26pc%3D1%26mtrcskv%3D100-1_75%2C50-1_75%2C50-1_100%2C60-1_100%2C65-1_75%2C70-1_75%2C80-1_75%26yieldlove_reload%3Dpid%253A17300.reload%253Afalse%26yieldlove_meta_reload%3Dpid%253A17300.reload%253Afalse%26yieldlove_reloads%3D0%26yieldlove_reload_count%3D0%26yieldlove_ab%3Dpo%253Adefault%26yieldlove_meta_ab%3Dpid%253A17300.po%253Adefault%26yieldlove_meta%3Dpid%253A17300.sb%253Af%26yieldlove_pid%3D17300%26yieldlove_hb_sucbid%3Dfalse%26hb_unit%3Drectangle2%26yieldlove_reloaded%3Dnever%26yieldlove_is_reloaded%3Dnever%26af%3Df1x1%2Cmrec&cust_params=tagm%3Dmt%26browserapp%3Dchrome%26viewportWidth%3D1581-1680%26viewportHeight%3D1153-1200%26tagtype%3Dsra%26yt%3D0%26adset%3Dbrsl%26nuggad%3Dn127-0%252Cn121-2%252Cn116-0%252Cn104-1%252Cn15-1%252Cn155-1%252Cn106-1%252Cn52-1%252Cn153-1%252Cn11-1%252Cn120-2%252Cn154-1%252Cn125-0%252Cn8-5%252Cn137-0%252Cn101-1%252Cn108-0%252Cn54-0%252Cn110-0%252Cn87-0%252Cn149-0%252Cn76-1%252Cn66-1%252Cn60-1%252Cn139-1%252Cn160-1%252Cn107-1%252Cn21-1%252Cn40-1%252Cn117-2%252Cn86-0%252Cn147-4%252Cn64-0%252Cn119-5%252Cn18-1%252Cn161-1%252Cn126-1%252Cn92-2%252Cn62-1%252Cn57-1%252Cn77-0%252Cn83-0%252Cn102-0%252Cn105-0%252Cn159-1%252Cn20-1%252Cn80-0%252Cn12-6%252Cn141-0%252Cn157-1%252Cn99-1%252Cn128-1%252Cn118-6%252Cn85-1%252Cn9-0%252Cn6-2%252Cn63-0%252Cn58-1%252Cn38-2%252Cn138-0%252Cn140-0%252Cn94-2%252Cn111-0%252Cn136-0%252Cn79-1%252Cn93-3%252Cn90-1%252Cn142-0%252Cn7-2%252Cn103-0%252Cn158-1%252Cn124-1%252Cn75-0%252Cn91-0%252Cn46-1%252Cn114-1%252Cn69-0%252Cn10-1%252Cn3-1%252Cn82-1%252Cn84-1%252Cn5-5%252Cn109-0%252Cn122-1%252Cn67-0%252Cn115-1%252Cn89-2%252Cn123-2%252Cn17-1%252Cn78-1%252Cn81-1%252Cn88-0%252Cn39-1%252Cn156-1%252Cn148-0%26keywords%3Dsec%252Cwirtschaft%252Capps%252Callesaussercorona%252Cantivirus%252Cdatensicherheit%252Cransomware%252Ctsilkcalb%252Citsicherheit%252Cmalware%252Cmedizin%252Ctrojaner%252Cvirus%252Cautorhannoboeck%252Cinternetsecurity%252Cdesktopapplikationen%252Csecurity&cookie_enabled=1&bc=31&abxe=1&lmt=1591908619&dt=1591908619107&dlt=1591908618337&idt=539&frm=20&biw=1600&bih=1200&oid=3&adxs=1385%2C790%2C1290%2C1145&adys=0%2C130%2C782%2C2582&adks=2121650524%2C494505520%2C531675200%2C87698206&ucis=2%7C3%7C4%7C5&ifi=3&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&dssz=69&icsg=3393333577662211&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=160x40%7C1000x10%7C10x20%7C300x12&msz=160x40%7C1000x10%7C10x20%7C300x10&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
bf4a3be9dfedb8111a29819e647796daee15c77b69d2074ae63230899b538f18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10435
x-xss-protection
0
google-lineitem-id
5379846600,4443777968,5379846600,4889801247
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138312397631,138302257088,138312416244,138267872671
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
bid
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/bid
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1591908619119&ns_c=UTF-8&cv=3.5&c8=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20...
  • https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1591908619119&ns_c=UTF-8&cv=3.5&c8=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%2...
0
528 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1591908619119&ns_c=UTF-8&cv=3.5&c8=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&c7=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&c9=&cs_ak_ss=1
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.96.130.160 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-130-160.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:19 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1591908619119&ns_c=UTF-8&cv=3.5&c8=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&c7=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&c9=&cs_ak_ss=1
Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:19 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame F717 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2342548244565729&output=html&h=150&slotname=9141079961&adk=3473268664&adf=1229236390&w=1000&lmt=1591908619&rafmt=11&psa=0&guci=1.2.0.0.2.2.0.0&format=1000x150&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&flash=0&wgl=1&adsid=NT&dt=1591908618849&bpp=16&bdt=513&idt=281&shv=r20200602&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=5160217340210&frm=20&pv=2&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&ga_fc=0&iag=0&icsg=3393333577662211&dssz=69&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=300&ady=1793&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=4293903088508887&pem=144&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8336&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6xIoTmpIR3&p=https%3A//www.golem.de&dtd=297
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-2342548244565729&output=html&h=150&slotname=9141079961&adk=3473268664&adf=1229236390&w=1000&lmt=1591908619&rafmt=11&psa=0&guci=1.2.0.0.2.2.0.0&format=1000x150&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&flash=0&wgl=1&adsid=NT&dt=1591908618849&bpp=16&bdt=513&idt=281&shv=r20200602&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=5160217340210&frm=20&pv=2&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&ga_fc=0&iag=0&icsg=3393333577662211&dssz=69&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=300&ady=1793&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=4293903088508887&pem=144&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8336&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6xIoTmpIR3&p=https%3A//www.golem.de&dtd=297
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 11 Jun 2020 20:50:19 GMT
server
cafe
content-length
27023
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Thu, 11-Jun-2020 21:05:19 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires
Thu, 11 Jun 2020 20:50:19 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ 		73 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d233c1838084b7e804e0e7a887190eeeb356132b1f625c7fa96ed3efd61e8b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591788966119694"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
27882
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 61B2 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2342548244565729&output=html&adk=3046330955&adf=2044148826&lmt=1591908619&plat=1%3A32776%2C2%3A32776%2C8%3A32768%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1591908618866&bpp=2&bdt=530&idt=288&shv=r20200602&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1000x150&nras=1&correlator=5160217340210&frm=20&pv=1&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&ga_fc=0&iag=0&icsg=3393333577662211&dssz=70&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=4293903088508887&pem=144&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8208&bc=31&ifi=1&uci=a!1&fsb=1&dtd=293
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-2342548244565729&output=html&adk=3046330955&adf=2044148826&lmt=1591908619&plat=1%3A32776%2C2%3A32776%2C8%3A32768%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1591908618866&bpp=2&bdt=530&idt=288&shv=r20200602&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1000x150&nras=1&correlator=5160217340210&frm=20&pv=1&ga_vid=614140971.1591908619&ga_sid=1591908619&ga_hid=219813472&ga_fc=0&iag=0&icsg=3393333577662211&dssz=70&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=4293903088508887&pem=144&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8208&bc=31&ifi=1&uci=a!1&fsb=1&dtd=293
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Thu, 11 Jun 2020 20:50:19 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Thu, 11-Jun-2020 21:05:19 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires
Thu, 11 Jun 2020 20:50:19 GMT
cache-control
private
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=219813472&t=pageview&_s=1&dl=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-518800-2&cid=614140971.1591908619&jid=2096983051&_gid=70199532.1591908619&gjid=544105129&_v=j82&z=873393179
35 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-518800-2&cid=614140971.1591908619&jid=2096983051&_gid=70199532.1591908619&gjid=544105129&_v=j82&z=873393179
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 11 Jun 2020 20:50:19 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:19 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-518800-2&cid=614140971.1591908619&jid=2096983051&_gid=70199532.1591908619&gjid=544105129&_v=j82&z=873393179
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
413
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
130 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j82&aip=1&a=219813472&t=timing&_s=2&dl=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&ul=en-us&de=UTF-8&dt=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=JS%20Dependencies&utv=load&utt=477&_u=IAhAAUAB~&jid=&gjid=&cid=614140971.1591908619&tid=UA-518800-2&_gid=70199532.1591908619&gtm=2ou640&z=327802519
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 May 2020 07:33:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1948632
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
userconnect
ih.adscale.de/ 		181 B
360 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ih.adscale.de/userconnect?ssl=1&sid=8d1441b6-e53b-4380-b7f5-a4ac4d5d5e8b&cbfn=stroeerCoreConnect&ts=1591908619175&umd=false&gdpr_err=CMP_CALL_FAILED
Requested by
Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.42.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-42-46.eu-central-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
6d62d5829b3adde8fec4b48d4f3f473a2fb2765e22e0d1d0afae1f77dcc56570

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 11 Jun 2020 20:50:19 GMT
server
Apache-Coyote/1.1
content-length
181
content-type
application/javascript
json
cpxl.golem.de/ 		0
474 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cpxl.golem.de/json
Requested by
Host: www.golem.de
URL: https://www.golem.de/staticrl/scripts/golem_main_114-min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:181 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
X-RateLimit-Limit
800
X-Powered-By
Express
Vary
X-HTTP-Method-Override
Access-Control-Allow-Methods
POST, OPTIONS
Access-Control-Allow-Origin
https://www.golem.de
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
X-RateLimit-Remaining
795
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
ETag
W/"a-oQDOV50e1MN2H/N8GYi+8w"
200623-syseleven-webtalk.jpg
www.golem.de/_img/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.golem.de/_img/200623-syseleven-webtalk.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:13c8:f5::f:4b3d:148 , Germany, ASN25291 (SYSELEVEN SysEleven GmbH, DE),
Reverse DNS
Software
nginx /
Resource Hash
b83b19265e1eda8e776d9fe74da535af70df00887914a2d0394ad5da7725c0a8

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:19 GMT
Last-Modified
Tue, 02 Jun 2020 11:18:57 GMT
Server
nginx
ETag
"5ed635a1-736e"
Content-Type
image/jpeg
Cache-Control
max-age=2678400
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=3
Content-Length
29550
Expires
Sun, 12 Jul 2020 20:50:19 GMT
map
ih.adscale.de/ Frame D296 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ih.adscale.de/map?format=display&ssl=1
Requested by
Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.42.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-42-46.eu-central-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash

Request headers

:method
GET
:authority
ih.adscale.de
:scheme
https
:path
/map?format=display&ssl=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
uu=f2c8bbd225874d8b8c462969c452c44e; ng=2#4066240072#26531810#0#d7~1&d10~5&d4~6&d11~0&d8~2&d9~2&d12~1&d1~1&d3~5
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
date
Thu, 11 Jun 2020 20:50:19 GMT
content-type
text/html;charset=ISO-8859-1
content-length
2596
server
Apache-Coyote/1.1
set-cookie
tu=4#4269809026#48~~442196~442196~1#101~~442196~442196~1#39~~442196~442196~1#40~~442196~442196~1#42~~442196~442196~1#75~~442196~442196~1#108~~442196~442196~1#63~~442196~442196~1; Max-Age=2592000; Domain=ih.adscale.de; Path=/; Secure; SameSite=None
nuggad
nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/
Redirect Chain
  • https://si.nuggad.net/rc?nuggn=571289945&nuggsid=1029839715
  • https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=1029839715
2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=1029839715
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:f600:1f:a1b:34c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.14.1 /
Resource Hash
5aa0ad9efad49670aabf98a6dc1a8b83d1e2219df1e19548f076fabff1b3cc45

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
via
1.1 21a3da42c823b5a4a2d9c4c63248bbd6.cloudfront.net (CloudFront)
server
nginx/1.14.1
x-amz-cf-pop
FRA2-C2
access-control-allow-methods
get, post, options
content-type
text/javascript
status
200
cache-control
s-maxage=86400, max-age=0
access-control-allow-credentials
true
x-cache
Miss from cloudfront
access-control-allow-headers
accept
content-length
2168
x-amz-cf-id
rpmYdFjLIhY91M1PxqPL51uy4dgABTXkYM3A39LPKnJbbRUcSgaTLw==

Redirect headers

date
Thu, 11 Jun 2020 20:50:19 GMT
via
1.1 9568a708c8ab21597698ebe7dce6c42e.cloudfront.net (CloudFront)
server
nginx/1.14.1
x-amz-cf-pop
FRA2-C1
status
302
access-control-allow-methods
get, post, options
content-type
text/html
location
https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=1029839715
access-control-allow-credentials
true
x-cache
Miss from cloudfront
access-control-allow-headers
accept
content-length
161
x-amz-cf-id
qqepdA41dqkwLTVCAOwvVVxQMawhKVgVc0GqRvQRwlGK1ro8_cs-jA==
nuggad
ih.adscale.de/ 		49 B
277 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ih.adscale.de/nuggad?/nvars/d7=2&d10=1&d4=0&d11=3&d8=2&d9=2&d12=2&d1=1&d3=3
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.42.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-42-46.eu-central-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 11 Jun 2020 20:50:19 GMT
server
Apache-Coyote/1.1
content-type
image/gif
content-length
49
p3p
CP=NOI PSA OUR
userx.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.es6.js
cdn.taboola.com/libtrc/ 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/stroeer-golemde/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
21032c2852ef9ad9113e806ce8f822e07561d7ab4c86c6e91a40c8f06f09635a

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
y_7W_3Wrkpm6Ho0FeWwD3X7YqcJZJW1h
content-encoding
gzip
etag
"79c0701abdd10e730f19867a30fe7d96"
age
23
x-cache
HIT
status
200
x-amz-replication-status
FAILED
content-length
7775
x-amz-id-2
tMB9IHvadQi+NcUZ3F+rmHcVcLjAssUcGoRg2JcYy///qLlXI9eb1iKs+Xi1pcATx8SzuvQm+20=
x-served-by
cache-fra19120-FRA
x-amz-expiration
expiry-date="Sun, 05 Jul 2020 00:00:00 GMT", rule-id="expire-versioned-static"
last-modified
Thu, 04 Jun 2020 15:21:39 GMT
server
AmazonS3
x-timer
S1591908620.607668,VS0,VE0
date
Thu, 11 Jun 2020 20:50:19 GMT
vary
Accept-Encoding
x-amz-request-id
2EBFA9046E7C4803
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
89
x-cache-hits
2
match
match.zorosrv.com/ Frame 8D3B
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
  • https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=4e80f856-6b31-4265-87b7-ce4f15d295ca
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=4e80f856-6b31-4265-87b7-ce4f15d295ca&tbid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&query=taboola_hm%3D4e80f856-6b31-...
  • https://match.zorosrv.com/match?tabid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&extuid=4e80f856-6b31-4265-87b7-ce4f15d295ca&excid=218&query=taboola_hm%3D4e80f856-6b31-4265-87b7-ce4f15d295ca
0
388 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.zorosrv.com/match?tabid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&extuid=4e80f856-6b31-4265-87b7-ce4f15d295ca&excid=218&query=taboola_hm%3D4e80f856-6b31-4265-87b7-ce4f15d295ca
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:35 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908636.538897,VS0,VE9
x-served-by
cache-fra19144-FRA
x-cache
MISS
p3p
policyref="/w3c/p3p.xml", CP="NOI IDC DSP COR CURa ADMa OUR IND COM STA NOR UNI"
status
200
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, X-Prototype-Version, Content-Type, Origin, Allow
content-length
0
x-cache-hits
0

Redirect headers

date
Thu, 11 Jun 2020 20:50:35 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908635.250627,VS0,VE9
x-served-by
cache-hhn4047-HHN
status
302
x-cache
MISS
location
https://match.zorosrv.com/match?tabid=dbec82c5-e7fd-497b-835a-d04c88ff027a-tuct5dc1e93&extuid=4e80f856-6b31-4265-87b7-ce4f15d295ca&excid=218&query=taboola_hm%3D4e80f856-6b31-4265-87b7-ce4f15d295ca
accept-ranges
bytes
content-length
0
x-cache-hits
0
/
trc.taboola.com/sg/rubicon-network-display/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698
  • https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KBB9AFJO-23-10EI
0
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KBB9AFJO-23-10EI
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:25 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908626.921725,VS0,VE9
x-cache
MISS
status
204
x-cache-hits
0
accept-ranges
bytes
x-served-by
cache-hhn4047-HHN

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KBB9AFJO-23-10EI
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Expires
0
/
am-sync.taboola.com/sg/powerlinksdsp-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://px.powerlinks.com/user/identify?sourceId=d4a7a706-ab0f-11e8-a038-127202fb7690&rurl=https%3A%2F%2Fam-sync.taboola.com%2Fsg%2Fpowerlinksdsp-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%24%7BUSER%7D...
  • https://sync.mathtag.com/sync/img?mt_exid=113&redir=%2F%2Fpx.powerlinks.com%2Fuser%2Fsync%2Fdsps%3FuserId%3D%5BMM_UUID%5D%26sourceId%3Daa4e7548-789b-4df8-a72f-d951a5b206eb%26sync%3D0%26rurl%3Dhttps...
  • https://sync.mathtag.com/sync/img?mt_exid=113&redir=%2F%2Fpx.powerlinks.com%2Fuser%2Fsync%2Fdsps%3FuserId%3D%5BMM_UUID%5D%26sourceId%3Daa4e7548-789b-4df8-a72f-d951a5b206eb%26sync%3D0%26rurl%3Dhttps...
  • https://px.powerlinks.com/user/sync/dsps?userId=89cc5ee2-990c-4200-8d86-1363c33a1540&sourceId=aa4e7548-789b-4df8-a72f-d951a5b206eb&sync=0&rurl=https%3A%2F%2Fam-sync.taboola.com%2Fsg%2Fpowerlinksdsp...
  • https://am-sync.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=BUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%3D
45 B
271 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=BUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%3D
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
tbl-x-upstream
10.40.20.9:10213
date
Thu, 11 Jun 2020 20:50:24 GMT
server
nginx
x-fastly-to-nlb-rtt
22278

Redirect headers

Location
https://am-sync.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=BUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU%3D
Date
Thu, 11 Jun 2020 20:50:24 GMT
Server
nginx
Connection
close
Etag
"BUabIH4oyvGm96xN4-ttB-9XLw1fl0f4AfAUvBGAnJU="
Content-Length
0
/
am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]&orig=trc
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]&orig=trc&mm_bnc&mm_bct&UUID=3d7b5ee2-990c-4d00-a0e1-6473bac50ade
  • https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=3d7b5ee2-990c-4d00-a0e1-6473bac50ade
0
226 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=3d7b5ee2-990c-4d00-a0e1-6473bac50ade
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
tbl-x-upstream
10.41.30.18:10213
date
Thu, 11 Jun 2020 20:50:20 GMT
server
nginx
x-fastly-to-nlb-rtt
23366

Redirect headers

Date
Thu, 11 Jun 2020 20:50:20 GMT
Server
MT3 2554 4906212 master zrh-pixel-x10
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://am-sync.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=3d7b5ee2-990c-4d00-a0e1-6473bac50ade
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 11 Jun 2020 20:50:19 GMT
/
am-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=562107&ev=1&rurl=https%3A%2F%2Fam-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=%%VGUID%%&orig=trc
  • https://am-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=ulJ1mkaxCQHU&ev=1&orig=trc&pid=562107
0
218 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=ulJ1mkaxCQHU&ev=1&orig=trc&pid=562107
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
tbl-x-upstream
10.41.30.18:10213
date
Thu, 11 Jun 2020 20:50:27 GMT
server
nginx
x-fastly-to-nlb-rtt
21834

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
status
302
content-language
en-US
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
location
https://am-sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=ulJ1mkaxCQHU&ev=1&orig=trc&pid=562107
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-stage-0
expires
-1
/
trc.taboola.com/sg/rtbhouse-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=taboola
  • https://ams.creativecdn.com/cm-notify?pi=taboola&tc=1
  • https://trc.taboola.com/sg/rtbhouse-network/1/rtb-h/?taboola_hm=fdp5qBg0a5ReXaC72psx&pi=taboola&tc=1
0
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/rtbhouse-network/1/rtb-h/?taboola_hm=fdp5qBg0a5ReXaC72psx&pi=taboola&tc=1
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
8
date
Thu, 11 Jun 2020 20:50:20 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908621.765522,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4047-HHN

Redirect headers

status
302
pragma
no-cache
date
Thu, 11 Jun 2020 20:50:20 GMT, Thu, 11 Jun 2020 20:50:20 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
location
https://trc.taboola.com/sg/rtbhouse-network/1/rtb-h/?taboola_hm=fdp5qBg0a5ReXaC72psx&pi=taboola&tc=1
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/taboola/?puid={user_id}&cb=https://am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/?taboola_hm=__ZUID__&orig=trc
  • https://b1sync.zemanta.com/usersync/taboola/?cb=https%3A%2F%2Fam-sync.taboola.com%2Fsg%2Fzemantartb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__ZUID__&orig=trc&puid=%7Buser_id%7D&s=2
  • https://am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/?taboola_hm=OpqTkU85aLWjpJbc4WDK
0
217 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/?taboola_hm=OpqTkU85aLWjpJbc4WDK
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
tbl-x-upstream
10.41.30.18:10213
date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
x-fastly-to-nlb-rtt
22785

Redirect headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
P3p
CP="We do not support P3P header."
Location
https://am-sync.taboola.com/sg/zemantartb-network/1/rtb-h/?taboola_hm=OpqTkU85aLWjpJbc4WDK
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
113
Expires
Thu, 01 Dec 1994 16:00:00 GMT
/
am-sync.taboola.com/sg/appnexus-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://ib.adnxs.com/getuidnb?https://am-sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=$UID&orig=trc
  • https://am-sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
0
228 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
tbl-x-upstream
10.41.32.36:10213
date
Thu, 11 Jun 2020 20:50:19 GMT
server
nginx
x-fastly-to-nlb-rtt
18702

Redirect headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
X-Proxy-Origin
185.236.201.148; 185.236.201.148; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.38:80
AN-X-Request-Uuid
145938c0-a0fa-4962-983d-c5defc6dc865
Server
nginx/1.13.4
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://am-sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECan4t7dd0UR0KIcupb4AOs&google_cver=1
0
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECan4t7dd0UR0KIcupb4AOs&google_cver=1
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:19 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908620.829593,VS0,VE9
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4047-HHN

Redirect headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:19 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECan4t7dd0UR0KIcupb4AOs&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
304
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 8D3B 		42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMxNjAmdGw9MTI5NjAw&piggybackCookie=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:20 GMT
X-lat
Pug23025:0:270
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42
rtb
am-sync.taboola.com/sg/google-network/1/ Frame 8D3B 		0
226 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/google-network/1/rtb?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D%7Bgdpr_applies%7D%26gdpr_consent%3D%7Bdaisybit%7D&orig=trc
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
tbl-x-upstream
10.40.20.9:10213
date
Thu, 11 Jun 2020 20:50:19 GMT
server
nginx
x-fastly-to-nlb-rtt
18829
/
am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://ib.adnxs.com/getuidnb?https://am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=$UID&orig=trc
  • https://am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
0
217 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
tbl-x-upstream
10.40.0.111:10213
date
Thu, 11 Jun 2020 20:50:20 GMT
server
nginx
x-fastly-to-nlb-rtt
23976

Redirect headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:22 GMT
X-Proxy-Origin
185.236.201.148; 185.236.201.148; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.183:80
AN-X-Request-Uuid
4c59c94e-137e-41bb-bb74-7d6cb91b317c
Server
nginx/1.13.4
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://am-sync.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=5710759689430337347&orig=trc
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=1eae4e99-6ead-4f5b-aa6f-23e1e01643eb
0
203 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=1eae4e99-6ead-4f5b-aa6f-23e1e01643eb
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
8
date
Thu, 11 Jun 2020 20:50:20 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908620.477367,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4047-HHN

Redirect headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:20 GMT
x-aspnet-version
4.0.30319
status
302
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=1eae4e99-6ead-4f5b-aa6f-23e1e01643eb
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
239
rtb-h
trc.taboola.com/sg/storygize-network/1/ Frame 8D3B
Redirect Chain
  • https://www.storygize.net/ccm/4b560cdd-91f9-422b-adb7-e9dff26bc3ad?u=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b
  • https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=37cf273d-6031-4a9e-b4c2-17b86d952301
0
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=37cf273d-6031-4a9e-b4c2-17b86d952301
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908621.294741,VS0,VE9
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4047-HHN

Redirect headers

Location
https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=37cf273d-6031-4a9e-b4c2-17b86d952301
Pragma
no-cache
cache-control
no-cache, no-store, must-revalidate
Connection
keep-alive
P3P
CP ALL ADM DEV PSAi COM OUR OTRo STP IND ONL
Content-Length
0
expires
0
cookiesync
bttrack.com/pixel/ Frame 8D3B 		35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=14b8c562-d12b-418b-b680-ad517d5839ec
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
46.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-ServerName
Track001-dc3
Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:20 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
/
cds.taboola.com/ Frame 8D3B 		0
157 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cds.taboola.com/?uid=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&_r=2327851
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:21 GMT
cache-control
no-store
x-envoy-upstream-service-time
5
Server
nginx
Connection
close
/
trc.taboola.com/sg/bidswitch-network/1/rtb-h/ Frame 8D3B
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola&bounced=1
  • https://x.bidswitch.net/sync?dsp_id=9&user_id=eCUZeRFXjsd.AikABlFypSXb7Q&expires=30&ssp=taboola
  • https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=ae07071c-bcbc-4822-8992-151eff285007
0
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=ae07071c-bcbc-4822-8992-151eff285007
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
8
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish
server
nginx
x-timer
S1591908621.399310,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4047-HHN

Redirect headers

status
302
date
Thu, 11 Jun 2020 20:50:21 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
location
//trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=ae07071c-bcbc-4822-8992-151eff285007
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
abtests
trc.taboola.com/stroeer-golemde/log/3/ 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/stroeer-golemde/log/3/abtests?route=AM:AM:V&lti=block_fast_clicks_2_varC&ri=fe78de9b9be8e36b2b883fcad84ea860&sd=v2_48550cf2b980d53898b3193527300d38_742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b_1591908619_1591908619_CNawjgYQ8ddKGLiml6mqLiABKAEwKziy0A1A0IgQSPKd3QNQ____________AVgAYABo4qaqkbKtl-Jw&ui=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&pi=/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&wi=-8843029467719283237&pt=text&vi=1591908619064&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22item-activation-manager%22%2C%22type%22%3A%22init%22%2C%22eventTime%22%3A1591908619591%7D&tim=22%3A50%3A19.591&id=7365&llvl=1&cv=20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT&
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:19 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4047-HHN
pragma
no-cache
server
nginx
x-timer
S1591908620.610635,VS0,VE9
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
cdn.taboola.com/static/c5/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/static/c5/c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
3GoWmPpnzFDs5CP3.ebHbCmhALWQMuvH
content-encoding
gzip
etag
"11d8569a7da0739259e3ac0b0d666e94"
age
17
via
1.1 varnish
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
1502
x-amz-id-2
6o4DfgP6eOOJG8x1tlOliEeH2ZNXhIKSj84PEKh45ccMLYZOtWCaBPIA+cFU7iBr27nrW4BQ+Dg=
x-served-by
cache-fra19120-FRA
last-modified
Sun, 10 Jun 2018 13:23:55 GMT
server
AmazonS3
x-timer
S1591908620.612225,VS0,VE0
date
Thu, 11 Jun 2020 20:50:19 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
x-amz-request-id
30EA11FC7289003C
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/svg+xml
access-control-allow-headers
*
abp
89
x-cache-hits
16
TB1099-TB1044-holding_silk_black_white-1000x600_1000x600_062bf6a0ee1fac3a387f593ebf70897a.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/b9476698-227d-4478-b354-042472d9181c/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/b9476698-227d-4478-b354-042472d9181c/TB1099-TB1044-holding_silk_black_white-1000x600_1000x600_062bf6a0ee1fac3a387f593ebf70897a.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
a369d2dc1c948b59fafe7de8a998b3e9d32894787676e783f158d4be4b2dd1cf

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
2607691
edge-cache-tag
623719357682245480008601987037349683538,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/b9476698-227d-4478-b354-042472d9181c/TB1099-TB1044-holding_silk_black_white-1000x600_1000x600_062bf6a0ee1fac3a387f593ebf70897a.png
content-length
6676
x-request-id
e0bd89cadd667c03228e6125444254fd
x-served-by
cache-dca17777-DCA, cache-dca17739-DCA, cache-fra19120-FRA
last-modified
Tue, 12 May 2020 15:58:29 GMT
server
cloudinary
x-timer
S1591908621.243620,VS0,VE1
etag
"fa12b606d4518fbca2cd5899744314db"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1
147696-227325-227324_rc.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/2004/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/2004/147696-227325-227324_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
e14ed51c90c75e021a73b2762f5d893ba43ffc099c5bfd26834b37759d6d52a0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
2093261
edge-cache-tag
307516031697107681755324145110710885738,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 13 Jun 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/2004/147696-227325-227324_rc.jpg
content-length
17378
x-served-by
cache-dca17773-DCA, cache-dca17772-DCA, cache-fra19120-FRA
last-modified
Wed, 13 May 2020 16:45:08 GMT
server
cloudinary
x-timer
S1591908621.263421,VS0,VE1
etag
"338fc3118c60f58ee929c137c00fbf53"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1
e80fdf87aefca478cec31875f3be3334.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e80fdf87aefca478cec31875f3be3334.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
052eee8a00286e769927cb9c3a9bee0d19f3c3c0a4fb0b1e51049c87742dbddc

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
2413933
edge-cache-tag
413364967975292133760895451307897398436,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 06 Jun 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e80fdf87aefca478cec31875f3be3334.png
content-length
15786
x-served-by
cache-dca17758-DCA, cache-dca17758-DCA, cache-fra19120-FRA
last-modified
Wed, 06 May 2020 10:02:14 GMT
server
cloudinary
x-timer
S1591908621.282721,VS0,VE1
etag
"907075beb8ff3569d871d2cc82c54811"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 12, 1
145911-218795-218794_rc.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/2001/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/2001/145911-218795-218794_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
e07cc9a19848f942ff4ac3c0f4eb082d728f7e0afdd76ede59eb34d36341fab9

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1832647
edge-cache-tag
405324015748079938564303058017002309497,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 22 May 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/2001/145911-218795-218794_rc.jpg
content-length
18305
x-served-by
cache-dca17769-DCA, cache-dca17747-DCA, cache-fra19120-FRA
last-modified
Tue, 21 Apr 2020 10:43:18 GMT
server
cloudinary
x-timer
S1591908621.302179,VS0,VE1
etag
"97fa11529ff8048398863102a89dc3c0"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1
142215-200639-200638_rc.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/1906/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/1906/142215-200639-200638_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
61c6055ce70b0f30a656960ac73834ec1c54b5fd195b8abb0cb3fd4ad6ba5ce3

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1259092
edge-cache-tag
453782511242693987936901164649636602895,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/1906/142215-200639-200638_rc.jpg
content-length
6529
x-request-id
db10c3541eb6d295806bce4027701975
x-served-by
cache-dca17731-DCA, cache-dca17779-DCA, cache-fra19120-FRA
last-modified
Mon, 11 May 2020 11:37:08 GMT
server
cloudinary
x-timer
S1591908621.325015,VS0,VE1
etag
"b9c8ba9257a7ead1b27b64c47b6808f1"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1
4dccf33f9457834e3beae33d5b6e3711.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4dccf33f9457834e3beae33d5b6e3711.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
5a698b0e0445a27e77e7e642cb8fe667299382c832b050a1244329b4c952c3ef

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
6115539
edge-cache-tag
461405616089828920733831722893191213476,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
HIT, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4dccf33f9457834e3beae33d5b6e3711.jpg
content-length
10006
x-request-id
11baaeb5395f9867b570e4eba62c7ba9
x-served-by
cache-dca17773-DCA, cache-dca17752-DCA, cache-fra19120-FRA
last-modified
Wed, 01 Apr 2020 11:33:38 GMT
server
cloudinary
x-timer
S1591908621.324961,VS0,VE1
etag
"8de5974310c960599ceb89ed1b6733ff"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 1
145617-217387-217386_rc.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/1912/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/1912/145617-217387-217386_rc.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
0dd32080d75e4cb798731cbb29880de81df5d2d18307ebf4f0429a97ed783204

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
2562280
edge-cache-tag
577223628739451361906382361128474510543,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Tue, 02 Jun 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.golem.de/1912/145617-217387-217386_rc.jpg
content-length
8522
x-served-by
cache-dca17734-DCA, cache-dca17734-DCA, cache-fra19120-FRA
last-modified
Sat, 02 May 2020 17:35:19 GMT
server
cloudinary
x-timer
S1591908621.347793,VS0,VE1
etag
"fcc9cf959ed3ecfd6ed18442575cfd74"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2, 1
53ffa1dc-6a2d-47a1-a3dc-5afc3f51a65f.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/53ffa1dc-6a2d-47a1-a3dc-5afc3f51a65f.jpg
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
ab9be1fc54950922c099303b0e849eb33a932e88925f6fbddf2132c6f201de9e

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Thu, 11 Jun 2020 20:50:21 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
810668
edge-cache-tag
335792423814290613916888089626980376310,358564119087106814747413934348384878343,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
HIT, MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_300%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/53ffa1dc-6a2d-47a1-a3dc-5afc3f51a65f.jpg
content-length
17004
x-request-id
f74799b77637e497d20c38415d45a5e4
x-served-by
cache-dca17729-DCA, cache-dca17779-DCA, cache-fra19120-FRA
last-modified
Tue, 02 Jun 2020 06:42:22 GMT
server
cloudinary
x-timer
S1591908621.347751,VS0,VE1
etag
"923e092686742376550b2bf23cacc6ea"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=7776000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 1
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 		254 B
612 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
3341
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
Vjnfq2okxpLEG/cBVxSfv3DOOCGN7KTpixt29L7DwUhoZL6eRlgDSODZqhfatrYL58q01gaLKf4=
x-served-by
cache-fra19120-FRA
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1591908620.653176,VS0,VE0
date
Thu, 11 Jun 2020 20:50:19 GMT
x-amz-request-id
F6D91014AAA6CDC4
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
89
x-cache-hits
3169
publishertag.prebid.js
static.criteo.net/js/ld/ 		67 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
7330ad6ba46b33e3f5a87b5e1da9aba23b8bda9e1034a109d0a944c06d1ae362

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Tue, 26 May 2020 12:28:56 GMT
server
nginx
etag
W/"5ecd0b88-10dca"
status
200
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
timing-allow-origin
*
expires
Fri, 12 Jun 2020 20:50:21 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 8528 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunU_8BDnyTuwJZ0H_HIlP4yGFpbdHWfktFJRaf1m_ENetYuG_A_mUQDKifdydMwSuLZDA5jukCM_wuUclut4IxoSq48SNxCgn8nnGA0YTKuHgk8gi2bEBsSg5teohbgcCqbLRGKNybhsW5gGSjMDSctzz_JrrkkaXCS8CFfTPe9kt2cHgEVJ7AUTU-8PWAWh2NPachvdwmKRBwr0RJYpK38sRm2PcGMm1t-2CNM1EkwzG6kjA54RS9KIKXqa_l3mscKYMlfLiTL52p9JbAha3K_1le5BClQolkjtpNd7Tc&sai=AMfl-YTehQj-6Gz6xeXNub75EZA0HYj_y9zvtBerwrqfAXPBCBcboUk_rn6FwTyHRJgfYI3pnY3caaJr8UaHJpop-qyGAYOKA2K3Su8JXgMr&sig=Cg0ArKJSzJZ_HHNJVgNjEAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
itfudnuj.js
ad4m.at/ Frame 8528 		65 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/itfudnuj.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.94.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.94.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
2107018c8f7339015b59579b71260b57df3e79174e37f1cf7de4817317b47093

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:36:45 GMT
content-encoding
gzip
age
814
x-guploader-uploadid
AAANsUnfVodffM2sgLvEk4omcBs5dvUq5tQFu9wpi3SUsSmvrqwM5r5ddJntPgpVKax3a4WSkZMVhk44AXsYcXOVQM3FiaSgMg
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16429
last-modified
Sat, 06 Jun 2020 10:24:17 GMT
server
UploadServer
etag
"16a2f88c95433277d1393674610a0fd5"
x-goog-hash
crc32c=yShkPg==, md5=FqL4jJVDMnfROTZ0YQoP1Q==
x-goog-generation
1591439057373910
cache-control
public, max-age=3600, no-transform
x-goog-stored-content-length
16429
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
expires
Thu, 11 Jun 2020 21:36:45 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 8528 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84058f4935f4a903f78426d22151ce5ca07e601bcf127fdc75f316b725be4c40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591788966119694"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28177
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame A4A5 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuajO3gS5OEDVuPPMNbL6VpCgzv4UOsSfrA_BiWOJ3IcFxEJusliKKb844WfdMHyGdciqqojXFD6NW6iBGldT0oKBFqCgT5MnNVOmWUJsRY6Fxbe6yGToxwJmty31k76F-mObmAPk8x4FWMLalr6kKk3gsQAdJNZ9CvD7NNIVyxrSmFnP0Do3Vkc3pkiMHOG_aBQ1A-8prX2mz7kCwgtpStOS-4cDa4E10fe-O4vhfQ88Dh5A7SvXfG5cZnKy8eZ29XfkKEb8-d-oLf8R7nA6Ioyw&sai=AMfl-YTVDGdMOCr_RoqNgSEEULYXZjMsipMD7nUPqzioA2cbqIdwrvqtZ9aI4eqEDKn7GabPmoXLtTGwutSJyVlVGbApTt2PQ8C_BdBih2pS&sig=Cg0ArKJSzMTMMPZbPiC7EAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
/
clarium.global.ssl.fastly.net/ Frame A4A5 		84 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://clarium.global.ssl.fastly.net/?wrapper=bOtueyOKIBMPxa062VVpqqpuUkg&tpid=Yk90dWV5T0tJQk1QeGEwNjJWVnBxcXB1VWtnL2FkZm9ybTo5NzB4MjUw&d=eyJ3aCI6IllrOTBkV1Y1VDB0SlFrMVFlR0V3TmpKV1ZuQnhjWEIxVld0bkwyRmtabTl5YlRvNU56QjRNalV3Iiwid2QiOnsiayI6eyJoYl9iaWRkZXIiOlsiYWRmb3JtIl0sImhiX3NpemUiOlsiOTcweDI1MCJdfX0sIndyIjowfQ==
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/prebid_v3l/202003181643/wrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e2ee3ef901c77ebb143440015f248ffa4bc50c35b6304838b838b2969a02e0f6

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:20 GMT
Content-Encoding
gzip
Age
39
X-Cache-Status
hit
X-Cache
HIT
X-Cache-Hits
1
Connection
keep-alive
Content-Length
23871
X-Served-By
cache-hhn4060-HHN
Pragma
no-cache
Access-Control-Allow-Origin
*
Server
nginx
X-Timer
S1591908620.218255,VS0,VE1
ETag
4bd52dfcb27c5ab90f42f92c0e3a2df64231da31
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Via
1.1 varnish
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Expires
Sat, 26 Jul 1997 04:59:59 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame A4A5 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84058f4935f4a903f78426d22151ce5ca07e601bcf127fdc75f316b725be4c40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591788966119694"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28177
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 436D 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTiQkjUhCQhqHIWZzaaCsZFxDhjhS44tE16jbO4FRINup9e4nUMuuCgXK_Q6lVDSV9nbLJUvaEiMlm_zh03ZPmdLNcRPTpkif2CVvOcEAB0UXvNz3DvOhGHwtGXqPsRPyr9rEwK13PYXSbYp0ctg8NrmqtWTtQcS8iXIeNJumwxQVuQ2rG-jPaNj47s_okN3gLChx21uSjWDTsmBLZ5gyUCQP-QE_YdOkY-drDpBTEi1m0etI9RKbakgtb6M0WrBHGQs4UxPUY49_BN0MF7nzxkSNXEO8orvMwzU-5&sai=AMfl-YRRtYZjJ2zCzch7_HZypl3z3TdsWZEcWXWLJjca5MqL8nizLjxxCeAJlli2bq9szUo7vIvh4Ter_kClWX3s7XErvZpvFNI9YM4SdqPW&sig=Cg0ArKJSzNwJ1Uttkh4DEAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
itfudnuj.js
ad4m.at/ Frame 436D 		65 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/itfudnuj.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.94.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.94.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
2107018c8f7339015b59579b71260b57df3e79174e37f1cf7de4817317b47093

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:36:45 GMT
content-encoding
gzip
age
814
x-guploader-uploadid
AAANsUnfVodffM2sgLvEk4omcBs5dvUq5tQFu9wpi3SUsSmvrqwM5r5ddJntPgpVKax3a4WSkZMVhk44AXsYcXOVQM3FiaSgMg
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
16429
last-modified
Sat, 06 Jun 2020 10:24:17 GMT
server
UploadServer
etag
"16a2f88c95433277d1393674610a0fd5"
x-goog-hash
crc32c=yShkPg==, md5=FqL4jJVDMnfROTZ0YQoP1Q==
x-goog-generation
1591439057373910
cache-control
public, max-age=3600, no-transform
x-goog-stored-content-length
16429
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
expires
Thu, 11 Jun 2020 21:36:45 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 436D 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84058f4935f4a903f78426d22151ce5ca07e601bcf127fdc75f316b725be4c40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591788966119694"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28177
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 76CE 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqThlQpUGn0aWFSW1Muq-FbmYNGCqE_OGn_SOQ7Pktskx8Nn3Wx-MFrnlxLjV2m0nhYSJ8PdOCQX_7mB51XM8tatjLxM9Ax9oOTC3hYTgbriKpYuGmQ54PhY689E37-S7J5nvs_O0qKewiYJvqA7IjGG4e8Qbkg-eyGuLI69RrqZ1fEgvCRdpUKSb3dRe64GW9yU_cBrP7cv-U4qGGcGqDC6K6OyNef1NqlkDekc88VcBULalj-oQU2uxYFGPIx8ONZ2OA_2AQpe_5iNQPeQ&sai=AMfl-YTto5emofgQsdw2uTpiZtgQdespIwLX1Xxr6fVxdpphPgxRaQ1k5H06N0Ibi2yweFzzig4jFXs9enj-ME_jf9xXvcHsWBAOloIP19nH&sig=Cg0ArKJSzACk-8WdzkwIEAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame 76CE 		44 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
sffe /
Resource Hash
8a36e599380e655f39c4efed4edac465f40054dd7c042e939bb6d42591b06088
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"540 / 213 of 1000 / last-modified: 1591893682"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14662
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 76CE 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060103.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84058f4935f4a903f78426d22151ce5ca07e601bcf127fdc75f316b725be4c40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591788966119694"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28177
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
win
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/win
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
win
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/win
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
win
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/win
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
win
prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/ 		0
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod-ingestion.tracking.v2.yieldlove-ad-serving.net/v2/win
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.131.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-131-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
access-control-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
pubads_impl_2020060803.js
securepubads.g.doubleclick.net/gpt/ Frame 76CE 		246 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060803.js?21066387
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
sffe /
Resource Hash
b67d56e8da32fd316174c18e3056154cfdbe6029fcc2e15b4318981f075172c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 09 Jun 2020 00:14:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
90021
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:19 GMT
integrator.sync.js
adservice.google.ch/adsid/ Frame 76CE 		113 B
175 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ch/adsid/integrator.sync.js?domain=www.golem.de
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
108
x-xss-protection
0
truncated
/ Frame 8528 		208 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2504a1a9f4ec25b22f33d65c528f1b6547c4798c9a0362d4a539e1eef928bca

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 8528 		0
54 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuBQ4AojaW1TCRdzcduHDp4hQH5k-aCcA8RINGtNvxMW99NEKYSIcx4NC5vbsdQzQYXa02hwrHAlOAz4Pt5D19KobfjTvkdgmeIiSbOWvEGkaoZUZuU_ItGZohw4agJmWR1EoD403m9ua-krhBx4Y-zuG2l6jIcKZVCFHXH7utboaF45SFBZXRMK7yCCXcxAbACv-4vTG3Z-gSgXe-metjFOtdZy7qNIMq_fS5JaCFuhqAbUeCZBJqFHevKcsfHbNN1SjAyv1lSKfLUs9Nab8G094PV&sai=AMfl-YQdM7VqJPwC6Rh4TPLNDw51HsokzDDfQxhGQN1p5SdOG5eJZfvdcFLYlVa7w1AyG5OF7S_eoePzRMT3ZO-l8UfOviRemEU9JYSL9-QJ&sig=Cg0ArKJSzNYPXtzhTtpIEAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:20 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
truncated
/ Frame 436D 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a9b2305efba696757b3aa33178a213641bf09a7da4819e65442e3a427ee21bce

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 436D 		0
54 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlUoo7O1yf2_Fr9-vpiWB1D3ksByw8X-DJ-uozLBA8XGEcY0bVIjiFuE62PNOKU_zHKaBCNl2UaI1Qp4vXD-wxFvutNw4RsJwsSsDGz-CDLs1NADmVsM_u9clSYplOHBxtSvjzt_2YjXFnq_-n1qVSuRGRw0PPC7NRnR03IOG-zpt8RaJu8wRfUPwzLS6BSfwLXymBaouiW1bGaaREKpaOjJjsVKljvujF_RpoYBJ_1EyxULXJvXwX0i0U0eTfbkL-pkVduufnWSAOPX-njqXL&sai=AMfl-YSNr7oYXl_0hgcH-f6UouFaQvzV5TxhEJ5H-4AyeYb4_8sMLFqC0grR2EFQa4yzNjD-TI-CY-vzgVA3vz0TbjhGHgBiRkqZHMHdSYu_&sig=Cg0ArKJSzM-zM9-Avzw-EAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:20 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMDZTAAKktFLkqFFlqwF23A52AwwA/k0FLEmvFytFh0FjvFklF9TEr5FzjFyhFwlFyfFx2AwmAhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAyzA53A2zAxmAzpF6lF9xAywA42BwwAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9zEr5FmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEzrF5mBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42Ax5A55A4BELlnFBUkzFYBP9SAAAAAAABcHqAPCAAFAAcHqTYeNAPAAAeUAKAABYeNAZBAAOA55A55A85B55A58E55A55AGAx3Ay1Aw4ArYeNASksFYFjAAAAAAAAAAAAEAAAcHqAAAAAAAHAklFzrF0vFwBFHAhyF0pFrlFsBFUAkpFzwFfjF0jFfnFvsFltFukElfFzkFHAxyAw4E2wAwBEMAxzA4zAxyAz5A32AzxAGAkpFylFj0FAAAAIAy5A53A21Az1AKA1zA35A40A22AwwADAzrF5BFKA1zA35A40A22AwwAKA1zA35A40A22AwwAuAlyAG0B00A0lAyGEkpFzwFfjF0jFfnFvsFltFukElfFzkFlyAGhFy0FprFlsFlyAGzFr5FdeUAKAAgCAYJAFAAAYeNAAAAAOATrF5zFjyFhwFlyFfxB2wAAAAAAAAAAAAAAAAAQtjFEdUHUA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:20 GMT
frame.html
ad4m.at/ Frame F1ED 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/itfudnuj.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.94.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.94.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/frame.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
x-guploader-uploadid
AAANsUn7eFZcWi4L3KRQdApKAlCbd0_xw_q98VWR2tRN0sY1NmgW-A0KmaYnJhi4bndMe2pkk2oXPLtNnwys5nrDXjprrxwy5g
expires
Thu, 11 Jun 2020 21:19:36 GMT
date
Thu, 11 Jun 2020 20:19:36 GMT
last-modified
Wed, 06 May 2020 15:09:30 GMT
etag
"73665aa82a805f129de0c81e7900d4f2"
x-goog-generation
1588777770164783
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1681
content-type
text/html
content-language
en
x-goog-hash
crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
content-length
1681
server
UploadServer
cache-control
public, max-age=3600
age
1844
alt-svc
clear
frame.html
ad4m.at/ Frame 5055 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/itfudnuj.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.94.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.94.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/frame.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
x-guploader-uploadid
AAANsUn7eFZcWi4L3KRQdApKAlCbd0_xw_q98VWR2tRN0sY1NmgW-A0KmaYnJhi4bndMe2pkk2oXPLtNnwys5nrDXjprrxwy5g
expires
Thu, 11 Jun 2020 21:19:36 GMT
date
Thu, 11 Jun 2020 20:19:36 GMT
last-modified
Wed, 06 May 2020 15:09:30 GMT
etag
"73665aa82a805f129de0c81e7900d4f2"
x-goog-generation
1588777770164783
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1681
content-type
text/html
content-language
en
x-goog-hash
crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
content-length
1681
server
UploadServer
cache-control
public, max-age=3600
age
1844
alt-svc
clear
ads
securepubads.g.doubleclick.net/gampad/ Frame 76CE 		335 B
231 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3117819483709546&correlator=659848492960179&output=ldjh&impl=fif&eid=21066387&vrg=2020060803&guci=2.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200611&iu_parts=53015287%2Cgolem.de_d_300x250_2_dc&enc_prev_ius=%2F0%2F1&prev_iu_szs=10x10%7C301x250%7C300x126%7C34x32&prev_scp=adslot%3Drectangle2%26src%3Dsdg%26yieldlove_pid%3D17300%26yieldlove_targeting%3D%257B%2522adset%2522%253A%255B%2522brsl%2522%255D%252C%2522adslot%2522%253A%255B%2522rectangle2%2522%255D%252C%2522af%2522%253A%255B%2522f1x1%2522%252C%2522mrec%2522%255D%252C%2522as%2522%253A%255B%2522rectangle2%2522%255D%252C%2522browserapp%2522%253A%255B%2522chrome%2522%255D%252C%2522hb_unit%2522%253A%255B%2522rectangle2%2522%255D%252C%2522keywords%2522%253A%255B%2522sec%2522%252C%2522wirtschaft%2522%252C%2522apps%2522%252C%2522allesaussercorona%2522%252C%2522antivirus%2522%252C%2522datensicherheit%2522%252C%2522ransomware%2522%252C%2522tsilkcalb%2522%252C%2522itsicherheit%2522%252C%2522malware%2522%252C%2522medizin%2522%252C%2522trojaner%2522%252C%2522virus%2522%252C%2522autorhannoboeck%2522%252C%2522internetsecurity%2522%252C%2522desktopapplikationen%2522%252C%2522security%2522%255D%252C%2522mtrcskv%2522%253A%255B%2522100-1_75%2522%252C%252250-1_75%2522%252C%252250-1_100%2522%252C%252260-1_100%2522%252C%252265-1_75%2522%252C%252270-1_75%2522%252C%252280-1_75%2522%255D%252C%2522nuggad%2522%253A%255B%2522n127-0%2522%252C%2522n121-2%2522%252C%2522n116-0%2522%252C%2522n104-1%2522%252C%2522n15-1%2522%252C%2522n155-1%2522%252C%2522n106-1%2522%252C%2522n52-1%2522%252C%2522n153-1%2522%252C%2522n11-1%2522%252C%2522n120-2%2522%252C%2522n154-1%2522%252C%2522n125-0%2522%252C%2522n8-5%2522%252C%2522n137-0%2522%252C%2522n101-1%2522%252C%2522n108-0%2522%252C%2522n54-0%2522%252C%2522n110-0%2522%252C%2522n87-0%2522%252C%2522n149-0%2522%252C%2522n76-1%2522%252C%2522n66-1%2522%252C%2522n60-1%2522%252C%2522n139-1%2522%252C%2522n160-1%2522%252C%2522n107-1%2522%252C%2522n21-1%2522%252C%2522n40-1%2522%252C%2522n117-2%2522%252C%2522n86-0%2522%252C%2522n147-4%2522%252C%2522n64-0%2522%252C%2522n119-5%2522%252C%2522n18-1%2522%252C%2522n161-1%2522%252C%2522n126-1%2522%252C%2522n92-2%2522%252C%2522n62-1%2522%252C%2522n57-1%2522%252C%2522n77-0%2522%252C%2522n83-0%2522%252C%2522n102-0%2522%252C%2522n105-0%2522%252C%2522n159-1%2522%252C%2522n20-1%2522%252C%2522n80-0%2522%252C%2522n12-6%2522%252C%2522n141-0%2522%252C%2522n157-1%2522%252C%2522n99-1%2522%252C%2522n128-1%2522%252C%2522n118-6%2522%252C%2522n85-1%2522%252C%2522n9-0%2522%252C%2522n6-2%2522%252C%2522n63-0%2522%252C%2522n58-1%2522%252C%2522n38-2%2522%252C%2522n138-0%2522%252C%2522n140-0%2522%252C%2522n94-2%2522%252C%2522n111-0%2522%252C%2522n136-0%2522%252C%2522n79-1%2522%252C%2522n93-3%2522%252C%2522n90-1%2522%252C%2522n142-0%2522%252C%2522n7-2%2522%252C%2522n103-0%2522%252C%2522n158-1%2522%252C%2522n124-1%2522%252C%2522n75-0%2522%252C%2522n91-0%2522%252C%2522n46-1%2522%252C%2522n114-1%2522%252C%2522n69-0%2522%252C%2522n10-1%2522%252C%2522n3-1%2522%252C%2522n82-1%2522%252C%2522n84-1%2522%252C%2522n5-5%2522%252C%2522n109-0%2522%252C%2522n122-1%2522%252C%2522n67-0%2522%252C%2522n115-1%2522%252C%2522n89-2%2522%252C%2522n123-2%2522%252C%2522n17-1%2522%252C%2522n78-1%2522%252C%2522n81-1%2522%252C%2522n88-0%2522%252C%2522n39-1%2522%252C%2522n156-1%2522%252C%2522n148-0%2522%255D%252C%2522pc%2522%253A%255B%25221%2522%255D%252C%2522tagm%2522%253A%255B%2522mt%2522%255D%252C%2522tagtype%2522%253A%255B%2522sra%2522%255D%252C%2522viewportheight%2522%253A%255B%25221153-1200%2522%255D%252C%2522viewportwidth%2522%253A%255B%25221581-1680%2522%255D%252C%2522yieldlove_ab%2522%253A%255B%2522po%253Adefault%2522%255D%252C%2522yieldlove_hb_sucbid%2522%253A%255B%2522false%2522%255D%252C%2522yieldlove_is_reloaded%2522%253A%255B%2522never%2522%255D%252C%2522yieldlove_meta%2522%253A%255B%2522pid%253A17300.sb%253Af%2522%255D%252C%2522yieldlove_meta_ab%2522%253A%255B%2522pid%253A17300.po%253Adefault%2522%255D%252C%2522yieldlove_meta_reload%2522%253A%255B%2522pid%253A17300.reload%253Afalse%2522%255D%252C%2522yieldlove_pid%2522%253A%255B%252217300%2522%255D%252C%2522yieldlove_reload%2522%253A%255B%2522pid%253A17300.reload%253Afalse%2522%255D%252C%2522yieldlove_reload_count%2522%253A%255B%25220%2522%255D%252C%2522yieldlove_reloaded%2522%253A%255B%2522never%2522%255D%252C%2522yieldlove_reloads%2522%253A%255B%25220%2522%255D%252C%2522yt%2522%253A%255B%25220%2522%255D%257D&eri=6&cookie=ID%3D1a8f5f9107ebf584%3AT%3D1591908619%3AS%3DALNI_MZL8Xy_Jg9YBI5X5aNqzgf7dLqsDQ&cdm=www.golem.de&bc=31&abxe=1&lmt=1591908620&dt=1591908620070&dlt=1591908619930&idt=122&ea=0&frm=23&biw=1600&bih=1200&isw=301&ish=250&oid=3&adxs=1000&adys=3571&adks=4008869679&ucis=78iv9vcvjnm7&ifi=1&ifk=2404414792&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&top=www.golem.de&dssz=8&icsg=10&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=301x10&msz=301x10&ga_vid=614140971.1591908619&ga_sid=1591908620&ga_hid=609930460&ga_fc=true&fws=256&ohw=0&btvi=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060803.js?21066387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
4591d0920ce6e3486096cb648c8c8b3ade1acecde9cff30f3b97e01140e6c9d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
156
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
42a5e1dcd8b9fdf4787e04106aaf119c.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 76CE 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://42a5e1dcd8b9fdf4787e04106aaf119c.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060803.js?21066387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 76CE 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060803.js?21066387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
truncated
/ Frame 76CE 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7987f334fa5e927c912da754adb07f762b92a5aa977ae82ac73f86d2aa97496e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 76CE 		0
45 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQ1D9lKNT3iyLfTvSl_C4eA1Dj9BLuSnoAYBdHy4Ds-FCpFwzSuXHE8KoV-v-xltCMOvqM6OOtT1ZiUfHLFivpqf0TVFZ_lsqFdxClPBW5oDiSBmcA2LA0EHUiGVjncDILGFwxmVHbgThDygyjjJvjgloEYwyg8Omm9YYRkuj9jfJ8fbhK_77X2ES0uNKhMHgsAXzQNgswUqSsslB46XCNF-4RmwGGKxpel38J6WImW9TG6snor2pOQ76D5nnfCqH58rtY1v-FSonn_D3kG-P4&sai=AMfl-YS0a27Mpl8Af26MasqgWgFJfS4EV_gRXuNsQp0qJh3S7A_zLwlPes9kwnxrj4bw0TFt-sj0lr9AUg7s0DnvmUEQvIJzjq9bYS1tSe77&sig=Cg0ArKJSzIQXa9O4Vvh3EAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:20 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMEeUAA/k0FjImvFytFh0FjvFklF9TEr5FzjFyhFwlFyfFx2AwmAhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAyzA53A2zAxmAzpF6lF9xAywA42BwwAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9zEr5FmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEzrF5mBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42Ax5A55A4mEvyFthF0jFvkFl9BNlFkpF1tFSlFj0FhuFnsFlmBhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAy0Ax2Ay0A0mAzpF6lF9zAwwA4yB1wAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9yEljF0hFunFslFmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEylFj0FhuFnsFlmBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42AywAwxA3BELlnFCUkzFYBPQAAAAAAAABsB3APBAAFAAsB3Tl5/APAAAoPASQABl5/AZBAAOA55A55A85B55A58E55A55AGAyyA1zA44Arl5/ASksFtFjAAAAAAAAAAAAEAAAsB3AAAAAAAHAklFzrF0vFwBFHAhyF0pFrlFsBFUAkpFzwFfjF0jFfnFvsFltFukElfFzkFHAzwAw4Ey1AwBEMAxzA4zAxyA0xA2yA00AGAkpFylFj0FAAAAIAy5A53A21Az1AKA1zA35A40A22AwwAJAylFj0FhuFnsFlBFKA1zA35A40A22AwwAKA1zA35A40A22AwwA0AlyAG0B00A0lAyGEkpFzwFfjF0jFfnFvsFltFukElfFzkFlyAGhFy0FprFlsFlyAGyFljF0hFunFslFdoPASQAsEA6DAFAAAl5/AAAAAPANlFkpF1tFSlFj0FhuFnsFlBFAAAAAAAAAAAAAAAAQtjFmThYWA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:20 GMT
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMFfUAA/k0FFNmvFytFh0FjvFklF9TEr5FzjFyhFwlFyfFx2AwmAhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAyzA53A2zAxmAzpF6lF9xAywA42BwwAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9zEr5FmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEzrF5mBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42Ax5A55A4mEvyFthF0jFvkFl9BNlFkpF1tFSlFj0FhuFnsFlmBhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAy0Ax2Ay0A0mAzpF6lF9zAwwA4yB1wAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9yEljF0hFunFslFmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEylFj0FhuFnsFlmBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42AywAwxA3mEvyFthF0jFvkFl9BNlFkpF1tFSlFj0FhuFnsFlmBhkF29B25Aw1Ax1A13A1mAjwFpkF9kElzFr0FvwFmhEwhF90A44A54AwxAy0A3mAjpFk9BxzA4yA23A43Ay2A3xAmzEp6Fl9BzwAx4Ey1AwmAzpF0lF9kEpzFwfFj0FjfFnvFslFtuBklFfzFkmBwsFhjFl9BhyF0pFrlFsmBhwFi9BylFj0FhuFnsFlyBmhEwjF90A44A54AwxAy0A3mAhwFk9B04A45A4wAxyA03AmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEylFj0FhuFnsFlyBmhEkjF9BEkYFtZEplFskFsvF2lFmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42AywAw4A3BELlnFDTkzFePEBAAAAAAAB4mdAPAAAFAA4mdTbosASksF8EjAAAAAAAAAAAAEAAA4mdAAAAAAAHAklFzrF0vFwBFHAhyF0pFrlFsBFUAkpFzwFfjF0jFfnFvsFltFukElfFzkFHAzwAx4Ey1AwBEMAxzA4yA23A43Ay2A3xANABkFYtBZpFlsFksFv2FlBFAAAAJA25Aw1Ax1A13A1BEKA04A45A4wAxyA03AKAylFj0FhuFnsFlyBKA04A45A4wAxyA03AKA04A45A4wAxyA03A1AlyAG0B00A0lAyGEkpFzwFfjF0jFfnFvsFltFukElfFzkFlyAGhFy0FprFlsFlyAGyFljF0hFunFslFyBEQtjF+IV6YA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:20 GMT
frame.html
ad4mat.net/ Frame 6C22 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4mat.net/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/itfudnuj.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
146.148.127.183 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.127.148.146.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
ad4mat.net
:scheme
https
:path
/frame.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:20 GMT
content-type
text/html
etag
W/"5acf0fb7-57f"
content-encoding
gzip
frame.html
ad4mat.net/ Frame 4E45 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4mat.net/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/itfudnuj.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
146.148.127.183 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.127.148.146.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
ad4mat.net
:scheme
https
:path
/frame.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:20 GMT
content-type
text/html
etag
W/"5acf0fb7-57f"
content-encoding
gzip
sodar
pagead2.googlesyndication.com/getconfig/ Frame 76CE 		7 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020060803&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060803.js?21066387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e4eace64ebe7e74d91a251c1ab70a944613b857ecd9e95c12b5932ba0a5c322a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
5550
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 76CE 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020060803.js?21066387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:20 GMT
/
track.adform.net/adfscript/ Frame A4A5 		20 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfscript/?bn=37314282;rtbwp=kDNm5u9Om2IF_XFtgcSMvqdgnaMU4Hum0;rtbdata=JPGycFPkrab-19wAZZxJ49JfP3_vJfaSPlQ7yZqqpTYCkqoxQQ0LwX9maskjoNZGrv1nC1ieZ6aKuM-ONkmISoyKgjuEy_PKuwkUe6ZRBvzZWr7MyfyxSaBCPpn20DTfgzFI_SUttAh0ZVvp_XnOL_DzRaZIo8kBv8ZfjLYyVsDYw1c9iLtcmhC4SBQUStfXxiKMLPUI_THwoGO4P1O6JE5dZH4SwUiF3DjLPH8oxJ02cYzUbv2Fv9Zjhti-vfXn5DK_DrA1i0Gltwe0vSv7Ig2U6eRnBA0fkxUvuCqDgZdxBQXPqCWJ2weEPpqPT96QOSIteHR7i5iFvM6Z82c3G26dVCpEniDSeihy17cMAys1;csid=9135;adxcmd=QTwuOIuaMWxxWXp_eBE_5w2;adxvars=gUoXqwTN3hwqHMLsI0XOHeO4u2dm-xD42vCrke-JUqrkME5qZYz69JT7WXJg35mTODx6rrQFgqn016pXAhp9_otU5BUI9NmBNKHiCZznyHREb6-yJz-dccJsgjtHD2ClicLsf7NCBqQ7k6MeQj2eFIs0gQ2d59t8BKvpZU1usEAgZwFsQhj5y_clRRPV2mvrEGoxcG7oO8V_FfTELfLoXsWjAexNyLOV0;
Requested by
Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=bOtueyOKIBMPxa062VVpqqpuUkg&tpid=Yk90dWV5T0tJQk1QeGEwNjJWVnBxcXB1VWtnL2FkZm9ybTo5NzB4MjUw&d=eyJ3aCI6IllrOTBkV1Y1VDB0SlFrMVFlR0V3TmpKV1ZuQnhjWEIxVld0bkwyRmtabTl5YlRvNU56QjRNalV3Iiwid2QiOnsiayI6eyJoYl9iaWRkZXIiOlsiYWRmb3JtIl0sImhiX3NpemUiOlsiOTcweDI1MCJdfX0sIndyIjowfQ==
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
49f6a71a428ca6e61b751b567bb2f92a873d0039e916381a0b8e74ee26508bc5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
10573
expires
-1
adx.js
s1.adform.net/banners/scripts/ Frame A4A5 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/banners/scripts/adx.js
Requested by
Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=bOtueyOKIBMPxa062VVpqqpuUkg&tpid=Yk90dWV5T0tJQk1QeGEwNjJWVnBxcXB1VWtnL2FkZm9ybTo5NzB4MjUw&d=eyJ3aCI6IllrOTBkV1Y1VDB0SlFrMVFlR0V3TmpKV1ZuQnhjWEIxVld0bkwyRmtabTl5YlRvNU56QjRNalV3Iiwid2QiOnsiayI6eyJoYl9iaWRkZXIiOlsiYWRmb3JtIl0sImhiX3NpemUiOlsiOTcweDI1MCJdfX0sIndyIjowfQ==
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
9a177a7eb550edc5245271ea26fb341eb424f26b3018059d3d940a0df6bb6d0c

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
last-modified
Mon, 30 Mar 2020 11:31:57 GMT
server
nginx
etag
W/"5e81d8ad-cd66"
x-cache-status
HIT
status
200
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
pixel
protected-by.clarium.io/ Frame A4A5 		68 B
345 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://protected-by.clarium.io/pixel?tag=wt_Yk90dWV5T0tJQk1QeGEwNjJWVnBxcXB1VWtnL2FkZm9ybTo5NzB4MjUw&v=5&s=c75f1e7c79ce897df7b1545bd409160aae5563f3&id=eyJwcmViaWQiOnsiYWRJZCI6IjY3MTkzNjQxMTIxYmQwNiIsImNwbSI6MC44OTkxNzkyNTYwODgxODIsImNySWQiOiIyMTc4M2ZiODYyNjA3ZTkiLCJzIjoiYmFubmVyIn19&sb=0&cb=7128743&h=www.golem.de
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.193.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-193-20.eu-central-1.compute.amazonaws.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:21 GMT
Server
nginx/1.14.0 (Ubuntu)
Content-Type
image/png
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
68
Expires
Sat, 26 Jul 1997 05:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame BFE4 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Thu, 11 Jun 2020 20:21:01 GMT
expires
Fri, 11 Jun 2021 20:21:01 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1759
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bootstrap.js
s1.adform.net/stoat/620/s1.adform.net/ Frame A4A5 		30 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Requested by
Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=bOtueyOKIBMPxa062VVpqqpuUkg&tpid=Yk90dWV5T0tJQk1QeGEwNjJWVnBxcXB1VWtnL2FkZm9ybTo5NzB4MjUw&d=eyJ3aCI6IllrOTBkV1Y1VDB0SlFrMVFlR0V3TmpKV1ZuQnhjWEIxVld0bkwyRmtabTl5YlRvNU56QjRNalV3Iiwid2QiOnsiayI6eyJoYl9iaWRkZXIiOlsiYWRmb3JtIl0sImhiX3NpemUiOlsiOTcweDI1MCJdfX0sIndyIjowfQ==
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
d15f979b292dbeac2c7a98a463bff77e9ab869378622c5f3528035713764c7f0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
last-modified
Tue, 19 May 2020 10:03:50 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Sat, 13 Jun 2020 00:26:19 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 76CE 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020060803&jk=3117819483709546&bg=!gYKlgppYSyVLdEv_KUUCAAAAPlIAAAAMmQF6jlEoyrRO6QlS-joOggBzmjYYaQGqFTgAAyJRe4yzRmLBHBSbNdkKKhYDdKK0Nibgrqehm9rLdU6Nrkb76-Gl2U9L4edMuGqEhlnkJs6WqflVyJ9XdsQBXPeun51qj6D2x2AMmc4WUnF9PqS6s6_9mi97A46IV2Fq6ZcdcAjloEQo5EWZsQlg1DcH-ydT0DRGK9t6Lr9oKmFsD5zB-0cK1z88-fbIeZkxZvJmfWbl3q2RziRmhRX1cEzecTsmamcWPLXrivUMBDSlUFtYRzKgpqtkT1wzMCqR-xx2U6oyBvk14fczuq7_TH7gmf7_J0vy7WjZPf1gtlwFXkfVyaqvS9BqgWuF4WIASYQZMXMCXG7ol38YE9HLQiL2kF_HOtfdGUhh2JzecN5vOXEn-8CMv1fM0j0NaCVbG07sxTIWXb59A7f2eq2G_q_vF7E4rHuqZTJYTpDPz-Pfjo5iEJvmVzb7qVR49vbD5Ngi--n5S58UaO3PguwMUC4n
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:20 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rar
ad4m.at/ad/ Frame DC2E
Redirect Chain
  • https://ad4m.at/rs?a=&b=38&c=680&d=LEnanX71C7guiOJ_StWP1m17DPBMLItg&e=160&f=600&g=1&h=Stroeer_RON_160x600&i=&j=1065&k=1&l=&m=&n=&o=0&p=0&q=&s=&t=0&r=
  • https://ad4m.at/ad/rar?a=14044%2C22451%2C15579&b=oneid6k4aef3fj5WHeHmHYtkt57gumt1T2Voneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2Coneidr3JTQf9fBkRfAH7Hjtqt2zrCwt8TKQoneid...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/ad/rar?a=14044%2C22451%2C15579&b=oneid6k4aef3fj5WHeHmHYtkt57gumt1T2Voneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2Coneidr3JTQf9fBkRfAH7Hjtqt2zrCwt8TKQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidYz2Srf3f1mbSVH9HetQtWe8aZt1T49oneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&f=oneidXe4czfrfqw7U6H4Het1CxD7U8tkTXQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidPXJaBfbfM5Qa9HjHbtgCR5Kabt9TPboneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidqWGumfWfD34TZHgHDtRC5wxfztgTADoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&c=160&d=600&e=LEnanX71C7guiOJ_StWP1m17DPBMLItg&g=c0f3f0cac9c573b2a23fd736c2e5cb1b%2F9797608355654343780&i=25007%2C25174%2C26474&j=16%2C16%2C41&k=0&l=0&m=0&n=&y=1&z=0
Requested by
Host: ad4m.at
URL: https://ad4m.at/itfudnuj.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.94.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.94.190.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/ad/rar?a=14044%2C22451%2C15579&b=oneid6k4aef3fj5WHeHmHYtkt57gumt1T2Voneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2Coneidr3JTQf9fBkRfAH7Hjtqt2zrCwt8TKQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidYz2Srf3f1mbSVH9HetQtWe8aZt1T49oneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&f=oneidXe4czfrfqw7U6H4Het1CxD7U8tkTXQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidPXJaBfbfM5Qa9HjHbtgCR5Kabt9TPboneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidqWGumfWfD34TZHgHDtRC5wxfztgTADoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&c=160&d=600&e=LEnanX71C7guiOJ_StWP1m17DPBMLItg&g=c0f3f0cac9c573b2a23fd736c2e5cb1b%2F9797608355654343780&i=25007%2C25174%2C26474&j=16%2C16%2C41&k=0&l=0&m=0&n=&y=1&z=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:20 GMT
content-type
text/html; charset=UTF-8
content-length
5598
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-security-policy
block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
expires
0
feature-policy
autoplay 'self';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';midi 'none';payment 'none';sync-xhr 'none';usb 'none';vr 'none'
pragma
no-cache
referrer-policy
same-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
surrogate-control
no-store
x-content-type-options
nosniff
x-download-options
noopen
x-xss-protection
1; mode=block
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
x-fastcgi-cache
BYPASS
x-backend-server
adsrv-b92v
via
1.1 google
alt-svc
clear

Redirect headers

status
307
server
nginx
date
Thu, 11 Jun 2020 20:50:20 GMT
location
https://ad4m.at/ad/rar?a=14044%2C22451%2C15579&b=oneid6k4aef3fj5WHeHmHYtkt57gumt1T2Voneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2Coneidr3JTQf9fBkRfAH7Hjtqt2zrCwt8TKQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidYz2Srf3f1mbSVH9HetQtWe8aZt1T49oneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&f=oneidXe4czfrfqw7U6H4Het1CxD7U8tkTXQoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidPXJaBfbfM5Qa9HjHbtgCR5Kabt9TPboneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600%2ConeidqWGumfWfD34TZHgHDtRC5wxfztgTADoneid__asuidLEnanX71C7guiOJ_StWP1m17DPBMLItgasuid__Stroeer_RON_160x600&c=160&d=600&e=LEnanX71C7guiOJ_StWP1m17DPBMLItg&g=c0f3f0cac9c573b2a23fd736c2e5cb1b%2F9797608355654343780&i=25007%2C25174%2C26474&j=16%2C16%2C41&k=0&l=0&m=0&n=&y=1&z=0
cache-control
private, no-store, max-age=0
x-fastcgi-cache
BYPASS
x-backend-server
rs-t9gn
via
1.1 google
alt-svc
clear
rar
ad4m.at/ad/ Frame 36A3
Redirect Chain
  • https://ad4m.at/rs?a=&b=39&c=680&d=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&e=300&f=250&g=1&h=Stroeer_RON_300x250&i=&j=1065&k=1&l=&m=&n=&o=0&p=0&q=&s=&t=0&r=
  • https://ad4m.at/ad/rar?a=14071%2C19490%2C20833&b=oneid7B2sqfzfz6kurHXHgtAtWVbFzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneid7B2sqfzf19ptrHXHgtAtVVZCzt1Trroneid...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/ad/rar?a=14071%2C19490%2C20833&b=oneid7B2sqfzfz6kurHXHgtAtWVbFzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneid7B2sqfzf19ptrHXHgtAtVVZCzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneidp5VS1fgfqYwTkH4HmtztQQBFbtRTEEoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&f=oneidEMzaDfEfAqDFzHAHjt6C34Zt4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidEMzaDfEf8YKszHAHjt6C44bf4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidJVAfzf5fR7ZUBH6H7tqCppGHjtgTbboneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&c=300&d=250&e=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&g=7c9aa75919900f42efc1c61a5aff2113%2F4193698186220969345&i=25091%2C20773%2C20774&j=16%2C14%2C14&k=0&l=0&m=0&n=&y=1&z=0
Requested by
Host: ad4m.at
URL: https://ad4m.at/itfudnuj.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.94.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.94.190.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/ad/rar?a=14071%2C19490%2C20833&b=oneid7B2sqfzfz6kurHXHgtAtWVbFzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneid7B2sqfzf19ptrHXHgtAtVVZCzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneidp5VS1fgfqYwTkH4HmtztQQBFbtRTEEoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&f=oneidEMzaDfEfAqDFzHAHjt6C34Zt4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidEMzaDfEf8YKszHAHjt6C44bf4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidJVAfzf5fR7ZUBH6H7tqCppGHjtgTbboneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&c=300&d=250&e=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&g=7c9aa75919900f42efc1c61a5aff2113%2F4193698186220969345&i=25091%2C20773%2C20774&j=16%2C14%2C14&k=0&l=0&m=0&n=&y=1&z=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:20 GMT
content-type
text/html; charset=UTF-8
content-length
5608
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-security-policy
block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
expires
0
feature-policy
autoplay 'self';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';midi 'none';payment 'none';sync-xhr 'none';usb 'none';vr 'none'
pragma
no-cache
referrer-policy
same-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
surrogate-control
no-store
x-content-type-options
nosniff
x-download-options
noopen
x-xss-protection
1; mode=block
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
x-fastcgi-cache
BYPASS
x-backend-server
adsrv-b92v
via
1.1 google
alt-svc
clear

Redirect headers

status
307
server
nginx
date
Thu, 11 Jun 2020 20:50:20 GMT
location
https://ad4m.at/ad/rar?a=14071%2C19490%2C20833&b=oneid7B2sqfzfz6kurHXHgtAtWVbFzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneid7B2sqfzf19ptrHXHgtAtVVZCzt1Trroneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2Coneidp5VS1fgfqYwTkH4HmtztQQBFbtRTEEoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&f=oneidEMzaDfEfAqDFzHAHjt6C34Zt4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidEMzaDfEf8YKszHAHjt6C44bf4tVTZZoneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250%2ConeidJVAfzf5fR7ZUBH6H7tqCppGHjtgTbboneid__asuidUEWnWuw3Z4sFbQCU17VMF_8Go_W0652dasuid__Stroeer_RON_300x250&c=300&d=250&e=UEWnWuw3Z4sFbQCU17VMF_8Go_W0652d&g=7c9aa75919900f42efc1c61a5aff2113%2F4193698186220969345&i=25091%2C20773%2C20774&j=16%2C14%2C14&k=0&l=0&m=0&n=&y=1&z=0
cache-control
private, no-store, max-age=0
x-fastcgi-cache
BYPASS
x-backend-server
rs-t9gn
via
1.1 google
alt-svc
clear
bulk
trc.taboola.com/stroeer-golemde/log/3/ 		0
78 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/stroeer-golemde/log/3/bulk?route=AM%3AAM%3AV&lti=block_fast_clicks_2_varC&bulkSize=1
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
10
date
Thu, 11 Jun 2020 20:50:20 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4047-HHN
pragma
no-cache
server
nginx
x-timer
S1591908621.637261,VS0,VE10
content-type
image/gif
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
/
track.adform.net/wpf/v2/Fla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2ieQTNHkdn.MqgXK_Pmtd0SHp815LyjaY2.rINj.rINM6uJ6o6e0T.5yjaY1WMsiZRP... Frame A4A5 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/wpf/v2/Fla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2ieQTNHkdn.MqgXK_Pmtd0SHp815LyjaY2.rINj.rINM6uJ6o6e0T.5yjaY1WMsiZRPrwXC_JEkNgvlE4yy2XElgebiYMpztNKscKsoUs_43wuZPup_nH2t05oaYAhrcpMxE6DBUr5xj6Kkveara3g9Rk4xf7_OLgiPFMtrs1OeyjaY1vSiwxEYEPgtpYMnGWpwoNSUC56MnGWVQdgFCoq1av4vFxF9Wu2MAR0odm_dhrxbuJjkWxv5iJ3A0KAGYichw.5B0KB.D9JtJ9cSr_WUaWUeWxv5icCmVWN9e4WX3NlY5DtTclY5B5Rhj.JNldj1DxqAeL9.gJ0Nc1lF4XVA4.L9.KNc0FAKXV4JhL90ftctDL90ftctDL90q_WL9.J1pNc0Qpw.43h/adfserve/?CC=1&bn=37314282;rtbwp=kDNm5u9Om2IF_XFtgcSMvqdgnaMU4Hum0;rtbdata=JPGycFPkrab-19wAZZxJ49JfP3_vJfaSPlQ7yZqqpTYCkqoxQQ0LwX9maskjoNZGrv1nC1ieZ6aKuM-ONkmISoyKgjuEy_PKuwkUe6ZRBvzZWr7MyfyxSaBCPpn20DTfgzFI_SUttAh0ZVvp_XnOL_DzRaZIo8kBv8ZfjLYyVsDYw1c9iLtcmhC4SBQUStfXxiKMLPUI_THwoGO4P1O6JE5dZH4SwUiF3DjLPH8oxJ02cYzUbv2Fv9Zjhti-vfXn5DK_DrA1i0Gltwe0vSv7Ig2U6eRnBA0fkxUvuCqDgZdxBQXPqCWJ2weEPpqPT96QOSIteHR7i5iFvM6Z82c3G26dVCpEniDSeihy17cMAys1;csid=9135;adxcmd=QTwuOIuaMWxxWXp_eBE_5w2;adxvars=gUoXqwTN3hwqHMLsI0XOHeO4u2dm-xD42vCrke-JUqrkME5qZYz69JT7WXJg35mTODx6rrQFgqn016pXAhp9_otU5BUI9NmBNKHiCZznyHREb6-yJz-dccJsgjtHD2ClicLsf7NCBqQ7k6MeQj2eFIs0gQ2d59t8BKvpZU1usEAgZwFsQhj5y_clRRPV2mvrEGoxcG7oO8V_FfTELfLoXsWjAexNyLOV0;;js=1;adfxid=1x;10336;set=en-US|en-US|1600X1200|0|950|250|24|8|3|7|0|0;fd=0|2&CREFURL=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Requested by
Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=bOtueyOKIBMPxa062VVpqqpuUkg&tpid=Yk90dWV5T0tJQk1QeGEwNjJWVnBxcXB1VWtnL2FkZm9ybTo5NzB4MjUw&d=eyJ3aCI6IllrOTBkV1Y1VDB0SlFrMVFlR0V3TmpKV1ZuQnhjWEIxVld0bkwyRmtabTl5YlRvNU56QjRNalV3Iiwid2QiOnsiayI6eyJoYl9iaWRkZXIiOlsiYWRmb3JtIl0sImhiX3NpemUiOlsiOTcweDI1MCJdfX0sIndyIjowfQ==
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
cd3627cbb4161b54ed6f0edaa6165ab0363caa2f4348b24443e62af10b11dcb1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
3547
expires
-1
truncated
/ Frame A4A5 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ebd4501ff7638a12e6afb1802e8d2164259435847795d3b520e530be11e91267

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
Standard
s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/ Frame A4A5 		89 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
ec4d67b8d84b3d6dfdb4f753777bfb8606d20b317df2cdd4ab2f707c13642474

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:20 GMT
content-encoding
gzip
last-modified
Tue, 19 May 2020 10:03:50 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Sat, 13 Jun 2020 00:30:43 GMT
5379846600
api.yieldlove-ad-serving.net/v1/bl/4444/ 		2 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.yieldlove-ad-serving.net/v1/bl/4444/5379846600
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.194.230.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-194-230-189.eu-central-1.compute.amazonaws.com
Software
/ Express
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
x-powered-by
Express
etag
W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
x-key
/bl/4444/5379846600
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=604800
content-length
2
activeview
pagead2.googlesyndication.com/pcs/ Frame 8528 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsthaOKMv9uzfjfeqjgMQmdpR8KCQGdyEcapKZqf566VVENqgIX1Wug0tPBdIJaFIKaRkdXtyIP3GPnAC5qpuyqUlfTrZxTVhBkHFRd_Xr0&sig=Cg0ArKJSzA5HXly9fc3JEAE&adk=2121650524&tt=-1&bs=1600%2C1200&mtos=846,1057,1057,1057,1057&tos=891,166,0,0,0&p=10,1310,610,1470&mcvt=1057&rs=0&ht=0&tfs=9&tls=1067&mc=1&lte=1&bas=0&bac=0&met=ce&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1591908619915&dlt&rpt=88&isd=0&msd=0&ext&xdi=0&ps=1600%2C5317&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-11-6-10-10-0-0-0&tvt=1062&is=160%2C600&iframe_loc=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200610
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 436D 		42 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv7X72TCJYKDNsacXfzotthYwk0-LCnTdyiLCuVPcxrXM4XHLadJ3KD_4UJiLiAmsucJlatMVofYbfMaXBPhtRBXokZ1g0Of_-vEKZ5dGo&sig=Cg0ArKJSzP9n9UBvUc6gEAE&adk=531675200&tt=-1&bs=1600%2C1200&mtos=0,0,1036,1036,1036&tos=0,0,1036,0,0&p=1042,1000,1292,1300&mcvt=1036&rs=0&ht=0&tfs=4&tls=1041&mc=0.63&lte=0.63&bas=0&bac=0&met=ce&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1591908619928&dlt&rpt=92&isd=0&msd=0&ext&xdi=0&ps=1600%2C5317&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-11-2-10-10-0-0-0&tvt=1040&is=300%2C250&iframe_loc=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200610
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
track.adform.net/csimpr/ Frame A4A5 		35 B
467 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/csimpr/?bn=37314282&csi=kixzCzMabHxE0RNGQPf_8HZEz1QFopbbSa9Vjarp-h_5T5X1jkznrhOPWGrRIMDj2WKmw_Ca3kOQoe_705DJPsP_xKVQvRWfA68PYS3bZI0-PuvUvtzoyw2
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
8128330.js
s1.adform.net/Banners/Elements/Files/2070608/8128330/ Frame 7F19 		17 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/8128330.js?ADFassetID=8128330&bv=257
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
1bfa1be80def9391a95c5f8de71a35425c01ede9e026b544f7709ed7a65df67c
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:29 GMT
server
nginx
status
200
etag
W/"5ec2d175-440e"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
publishertag.prebid.js
static.criteo.net/js/ld/ 		67 KB
21 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
7330ad6ba46b33e3f5a87b5e1da9aba23b8bda9e1034a109d0a944c06d1ae362

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Tue, 26 May 2020 12:28:56 GMT
server
nginx
etag
W/"5ecd0b88-10dca"
status
200
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
timing-allow-origin
*
expires
Fri, 12 Jun 2020 20:50:21 GMT
Adform.DHTML.js
s1.adform.net/banners/scripts/rmb/ Frame 7F19 		30 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=620
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
09367caa70514803713fced8ee4ac247e1fbefe5fb13502fb24f20b46804d826

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 16:13:27 GMT
server
nginx
etag
W/"5ec2b427-7875"
x-cache-status
HIT
status
200
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
vfScriptEditorial.js
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 7F19 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/vfScriptEditorial.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
50bd5e7886676f4c5bf147334237a55389bbc6828a1b37cc361eefd8a0f7f768
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:29 GMT
server
nginx
status
200
etag
W/"5ec2d175-218b"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
fdChanges.js
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 7F19 		2 KB
1015 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/fdChanges.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
4327b6188850d45e54074d2c921310d37a337e8051e11d9df0e73b391fdedb43
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:28 GMT
server
nginx
status
200
etag
W/"5ec2d174-636"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
styles.css
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 7F19 		23 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/styles.css
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
310c53f5e78d20fcfe0ac0ab504cf3a0ad6bcd8ce2b7eb54fe1cb5a2fbe81229
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:29 GMT
server
nginx
status
200
etag
W/"5ec2d175-5ce5"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
text/css
logo_default.svg
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 7F19 		8 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/logo_default.svg
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
ef0c05d2d6f69f777642d94ddd573cd4b9916dccd84e7e008d29007a574cee01
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:28 GMT
server
nginx
status
200
etag
W/"5ec2d174-1e4d"
x-cache-status
HIT
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
strict-transport-security
max-age=0
content-type
image/svg+xml
menu_01.png
pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/ Frame 7F19
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_01...
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_01.png
59 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_01.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.222 , Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
rc18v1202.dnh.net
Software
nginx / PleskLin
Resource Hash
798a3de5fe5499327dddc0095cc0e31894969b62084db415c12ffa9faf3eb3ab

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:52:54 GMT
Last-Modified
Mon, 11 May 2020 06:18:48 GMT
Server
nginx
X-Powered-By
PleskLin
ETag
"5eb8ee48-ec74"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Range
Content-Length
60532

Redirect headers

date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_01.png
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
407
menu_02.png
pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/ Frame 7F19
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_02...
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_02.png
34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_02.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.222 , Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
rc18v1202.dnh.net
Software
nginx / PleskLin
Resource Hash
92bc2c43213b90e183b575b92067ecec666b30a739d5fecbc7a4140c794aa09e

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:52:55 GMT
Last-Modified
Mon, 11 May 2020 06:18:47 GMT
Server
nginx
X-Powered-By
PleskLin
ETag
"5eb8ee47-867e"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Range
Content-Length
34430

Redirect headers

date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_02.png
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
407
menu_03.png
pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/ Frame 7F19
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_03...
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_03.png
47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_03.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.222 , Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
rc18v1202.dnh.net
Software
nginx / PleskLin
Resource Hash
efb4cb441012a3c40b61286fb57bb119a94c40ac6b030dcfad742d9be070a9ed

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:52:54 GMT
Last-Modified
Mon, 11 May 2020 06:18:47 GMT
Server
nginx
X-Powered-By
PleskLin
ETag
"5eb8ee47-bb1a"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Range
Content-Length
47898

Redirect headers

date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_03.png
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
407
menu_04.png
pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/ Frame 7F19
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_04...
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_04.png
50 KB
50 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_04.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.222 , Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
rc18v1202.dnh.net
Software
nginx / PleskLin
Resource Hash
0086c9eeccc3347ecac92f6f6777e32de8f8d0ad7d368d309a6fa6cff066cc2e

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:52:54 GMT
Last-Modified
Mon, 11 May 2020 06:18:47 GMT
Server
nginx
X-Powered-By
PleskLin
ETag
"5eb8ee47-c833"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Range
Content-Length
51251

Redirect headers

date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/menu_04.png
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
407
scripts.js
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 7F19 		59 B
382 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/scripts.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.187/e/.wSBgiD/i/8IC-4gAAAAKAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
00ad99ec679b1f9f487e9efeff19175a6c4ffbbe92ceb3a099362e5d1b41073b
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:28 GMT
server
nginx
status
200
etag
W/"5ec2d174-3b"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
event.gif
io.fusedeck.net/t/ Frame 7F19 		35 B
160 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.fusedeck.net/t/event.gif?propertyId=ui7l9sF6hS&eventId=40104&payload={%22values%22:%20{%22adname%22:%22EngagementBanner_Sunstar_Personen_970x250%22}}
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.221.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-221-188.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Thu, 11 Jun 2020 20:50:22 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
35
expires
0
slide_01.html
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 710C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_01.html
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

:method
GET
:authority
s1.adform.net
:scheme
https
:path
/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_01.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
C=1; adtrc=1; uid=-7884115242941919908; TPC=1591908620670
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:21 GMT
content-type
text/html
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public max-age=604800
strict-transport-security
max-age=0
content-encoding
gzip
x-cache-status
HIT
slide_02.html
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 9006 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_02.html
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

:method
GET
:authority
s1.adform.net
:scheme
https
:path
/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_02.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
C=1; adtrc=1; uid=-7884115242941919908; TPC=1591908620670
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:21 GMT
content-type
text/html
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public max-age=604800
strict-transport-security
max-age=0
content-encoding
gzip
x-cache-status
HIT
slide_03.html
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 1780 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_03.html
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

:method
GET
:authority
s1.adform.net
:scheme
https
:path
/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_03.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
C=1; adtrc=1; uid=-7884115242941919908; TPC=1591908620670
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:21 GMT
content-type
text/html
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public max-age=604800
strict-transport-security
max-age=0
content-encoding
gzip
x-cache-status
HIT
slide_04.html
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 1938 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_04.html
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

:method
GET
:authority
s1.adform.net
:scheme
https
:path
/Banners/Elements/Files/2070608/8128330/bvpath_257/slide_04.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
C=1; adtrc=1; uid=-7884115242941919908; TPC=1591908620670
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:21 GMT
content-type
text/html
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public max-age=604800
strict-transport-security
max-age=0
content-encoding
gzip
x-cache-status
HIT
tm.js
io.fusedeck.net/d/ Frame 7F19 		129 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://io.fusedeck.net/d/tm.js?p=LT2SyOBTdo&l=fdData&h=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.221.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-221-188.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
5ea6305227bc5aab4c6cc7760551942da92e29cde1bc5aec40e5edea6a7df974

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:22 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
no-cache, no-store, must-revalidate
expires
0
bg_muster.png
pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/ Frame 7F19
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/bg_must...
  • https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/bg_muster...
37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/bg_muster.png
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.222 , Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
rc18v1202.dnh.net
Software
nginx / PleskLin
Resource Hash
b07df8711e488313141e80adadeead6cd6f68c689a43e66fc31f05c0f9252381

Request headers

Referer
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:52:54 GMT
Last-Modified
Mon, 11 May 2020 16:04:33 GMT
Server
nginx
X-Powered-By
PleskLin
ETag
"5eb97791-931e"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Range
Content-Length
37662

Redirect headers

date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe06.sitebarad.com/riverhost/Capture%20Media/Engagement%20Ad/Sunstar/0001%20Engagement%20Ad%20Mai%202020/02_Sunstar_Symbole_Engagement_Ad/vF970x250_Sunstar_Symbole_Engagement_Ad/bg_muster.png
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
409
365C4C_0_0.woff2
s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/ Frame 7F19 		45 KB
46 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/365C4C_0_0.woff2
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
9f4253373ca10d7fa488777a9fe7f09cd06f88d48218047773d7e279b8c68dde
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://s1.adform.net/Banners/Elements/Files/2070608/8128330/bvpath_257/styles.css
Origin
https://www.golem.de

Response headers

date
Thu, 11 Jun 2020 20:50:21 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 18:18:26 GMT
server
nginx
status
200
etag
W/"5ec2d172-b559"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
text/plain
/
adx.adform.net/adx/unload/ Frame A4A5 		35 B
302 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adx.adform.net/adx/unload/?eyJjIjoiIiwidCI6bnVsbCwiZ2RwciI6bnVsbCwiZ2Rwcl9jb25zZW50IjpudWxsLCJ1IjpbeyJ2IjoiZ1VvWHF3VE4zaHdxSE1Mc0kwWE9IZU80dTJkbS14RDQydkNya2UtSlVxcmtNRTVxWll6NjlKVDdXWEpnMzVtVE9EeDZyclFGZ3FuMDE2cFhBaHA5X290VTVCVUk5Tm1CTktIaUNaem55SFJFYjYteUp6LWRjY0pzZ2p0SEQyQ2xpY0xzZjdOQ0JxUTdrNk1lUWoyZUZJczBnUTJkNTl0OEJLdnBaVTF1c0VBZ1p3RnNRaGo1eV9jbFJSUFYybXZyRUdveGNHN29POFZfRmZURUxmTG9Yc1dqQWV4TnlMT1YwIiwicCI6eyJtYyI6MCwibXQiOjAsInZwIjoxMDAsInZ0IjoxMDAwLCJyIjowLCJhIjp0cnVlLCJ0dCI6MX19XX0
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate, no-transform
expires
-1
/
adx.adform.net/adx/unload/ 		35 B
302 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adx.adform.net/adx/unload/?eyJjIjoiIiwidCI6bnVsbCwiZ2RwciI6bnVsbCwiZ2Rwcl9jb25zZW50IjpudWxsLCJ1IjpbeyJ2IjoiZ1VvWHF3VE4zaHdxSE1Mc0kwWE9IZU80dTJkbS14RDQydkNya2UtSlVxcmtNRTVxWll6NjlKVDdXWEpnMzVtVE9EeDZyclFGZ3FuMDE2cFhBaHA5X290VTVCVUk5Tm1CTktIaUNaem55SFJFYjYteUp6LWRjY0pzZ2p0SEQyQ2xpY0xzZjdOQ0JxUTdrNk1lUWoyZUZJczBnUTJkNTl0OEJLdnBaVTF1c0VBZ1p3RnNRaGo1eV9jbFJSUFYybXZyRUdveGNHN29POFZfRmZURUxmTG9Yc1dqQWV4TnlMT1YwIiwicCI6eyJtYyI6MCwibXQiOjAsInZwIjoxMDAsInZ0IjoxMDAwLCJyIjowLCJhIjp0cnVlLCJ0dCI6MX19XX0
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:21 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate, no-transform
expires
-1
ixmatch.html
js-sec.indexww.com/um/ Frame 2B12 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.9.98 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-9-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
js-sec.indexww.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

Server
Apache
Last-Modified
Mon, 19 Jun 2017 19:18:19 GMT
ETag
"e20015-112-55254ff6a1972"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
211
Date
Thu, 11 Jun 2020 20:50:22 GMT
Connection
keep-alive
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame BB6F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.9.13 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
icu=ChgIt6FYEAoYASABKAEwjLKK9wU4AUABSAEQjLKK9wUYAA..; uuid2=5710759689430337347
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

Connection
keep-alive
Content-Length
506
Server
nginx/1.9.13
Content-Type
text/html
Last-Modified
Fri, 20 May 2016 02:07:09 GMT
ETag
W/"573e714d-3e3"
Expires
Sun, 06 Aug 2017 09:41:59 GMT
Cache-Control
max-age=31536000
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish 1.1 varnish
Accept-Ranges
bytes
Date
Thu, 11 Jun 2020 20:50:23 GMT
Age
26824107
X-Served-By
cache-jfk8138-JFK, cache-fra19142-FRA
X-Cache
HIT, HIT
X-Cache-Hits
391291, 1074377
X-Timer
S1591908623.430476,VS0,VE0
Vary
Accept-Encoding
pd
eu-u.openx.net/w/1.0/ Frame 2393 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=2671f27c-3f24-410f-8105-4de0c801f2a9&gdpr=0
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.188.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=2671f27c-3f24-410f-8105-4de0c801f2a9&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=9cf4ffe4-472c-0461-3859-0af1ba001eff|1591908618
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=9cf4ffe4-472c-0461-3859-0af1ba001eff|1591908618; Version=1; Expires=Fri, 11-Jun-2021 20:50:23 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1591908623|mOkivNmWiygu; Version=1; Expires=Fri, 26-Jun-2020 20:50:23 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.188.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 11 Jun 2020 20:50:23 GMT
content-type
text/html
content-length
383
content-encoding
gzip
via
1.1 google
alt-svc
clear
showad.js
ads.pubmatic.com/AdServer/js/ Frame 57EC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.9.34 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-9-34.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KRTBCOOKIE_734=15208-742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&KRTB&23151-742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b; PugT=1591908620; PUBMDCID=3
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

Last-Modified
Tue, 14 Apr 2020 10:27:52 GMT
ETag
"13006b6-a4bb-5a33da6f1a023"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
15243
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=31954
Expires
Fri, 12 Jun 2020 05:42:57 GMT
Date
Thu, 11 Jun 2020 20:50:23 GMT
Connection
keep-alive
Vary
Accept-Encoding
index.html
cdn.districtm.io/ids/ Frame 6C9C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
204
date
Thu, 11 Jun 2020 20:50:22 GMT
set-cookie
__cfduid=d9572afed8ab10f0093de2872f714112c1591908622; expires=Sat, 11-Jul-20 20:50:22 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Origin
access-control-allow-methods
GET, HEAD, POST, OPTIONS
cf-request-id
0346bef7420000cc4ef4156200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
5a1e34386da5cc4e-ZRH
usync.html
eus.rubiconproject.com/ Frame 63DC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: cdn-a.yieldlove.com
URL: https://cdn-a.yieldlove.com/yieldlove-bidder-stroeer.js?golem.de
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
rsid=1|AIfsdBUH+v3fWCPuzNowDE/csJlhKa2tmCxRUZWfPQx8p4D5NG3hRaqTCqCJieGkTxzCtz/GWjvGSkTNWjmsGgfE/2wGlVwK8BMqZcvhERs6oGLGBr9ZPMX4JPKBYjCRbro=; ses15=; vis15=241806^1; ses10=; vis10=241806^1; khaos=KBB9AFJO-23-10EI; ses55=; vis55=241806^1; audit=1|hLZGFuTafB36mQ+DMmnxBRxZXcJNOYA1UeAItJYEIAmDv1z0BnnBdW69RYya3iefwtNXUxOvlNtD+EbPh3UKYLKpUjWTmmg0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Fri, 29 May 2020 23:03:21 GMT
Content-Encoding
gzip
Content-Length
9232
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=85194
Expires
Fri, 12 Jun 2020 20:30:19 GMT
Date
Thu, 11 Jun 2020 20:50:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
/
tt.onthe.io/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/?k[]=43067:uniques_holding&s=6acc7c777cce3be138a245218c439c54&__io=0dd343421.729be1b2c_1591908619011&1591908622523
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:22 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
container
tracking.m6r.eu/pixel/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.m6r.eu/pixel/container?pixelId=eaa843f7-840a-4a36-8fdd-3b79df0d4fa0&n127=0&n121=2&n116=0&n104=1&n15=1&n155=1&n106=1&n52=1&n153=1&n11=1&n120=2&n154=1&n125=0&n8=5&n137=0&n101=1&n108=0&n54=0&n110=0&n87=0&n149=0&n76=1&n66=1&n60=1&n139=1&n160=1&n107=1&n21=1&n40=1&n117=2&n86=0&n147=4&n64=0&n119=5&n18=1&n161=1&n126=1&n92=2&n62=1&n57=1&n77=0&n83=0&n102=0&n105=0&n159=1&n20=1&n80=0&n12=6&n141=0&n157=1&n99=1&n128=1&n118=6&n85=1&n9=0&n6=2&n63=0&n58=1&n38=2&n138=0&n140=0&n94=2&n111=0&n136=0&n79=1&n93=3&n90=1&n142=0&n7=2&n103=0&n158=1&n124=1&n75=0&n91=0&n46=1&n114=1&n69=0&n10=1&n3=1&n82=1&n84=1&n5=5&n109=0&n122=1&n67=0&n115=1&n89=2&n123=2&n17=1&n78=1&n81=1&n88=0&n39=1&n156=1&n148=0
Requested by
Host: tracking.m6r.eu
URL: https://tracking.m6r.eu/sync/api?checkcookies=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.56.30.78 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-56-30-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
28996d02ced2278c306838e1241d3219a27187c9f6057923ff3e3b8917afacbe

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:23 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Content-Length
1516
tfa.js
cdn.taboola.com/libtrc/unip/1176195/ Frame 7F19 		61 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/unip/1176195/tfa.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9979a8bb08e760486cf14c491d75a0c647bb2e133e3daba53a63132a99f14c1e

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
rChQl4CEY0ZGOTX5w.HzAcHsKjm6YcXo
content-encoding
gzip
etag
"10a647902350f1c47d490761857c9378"
age
129
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
21143
x-amz-id-2
5KTXlA3OoNcitUrS8yDh2csG4r1RXtcrYxPwGwLWTVgtj9MYGhTEZwTEbtEN/Vd4iQw1b3eCK2U=
x-served-by
cache-fra19120-FRA
last-modified
Wed, 03 Jun 2020 11:28:25 GMT
server
AmazonS3
x-timer
S1591908623.065314,VS0,VE1
date
Thu, 11 Jun 2020 20:50:23 GMT
vary
Accept-Encoding
x-amz-request-id
94A70C326429C8AB
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
35
x-cache-hits
1
json
trc.taboola.com/1176195/trc/3/ Frame 7F19 		745 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1176195/trc/3/json?tim=1591908623087&data=%7B%22id%22%3A518%2C%22ii%22%3A%22%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3A%22742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b%22%2C%22vi%22%3A1591908623081%2C%22cv%22%3A%2220200603-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%3F%22%2C%22e%22%3A%22N%2FA%22%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22mpv%22%3Atrue%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dcapturemedia-sunstar-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1176195/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7c583ff6dde540cb3e4e03f02a23ea9706c67a247e8e6e21b97f5552583889af

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
59
date
Thu, 11 Jun 2020 20:50:23 GMT
content-encoding
gzip
access-control-allow-origin
*
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
x-served-by
cache-hhn4047-HHN
server
nginx
x-timer
S1591908623.099189,VS0,VE59
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
/
cds.taboola.com/ Frame 7F19 		0
157 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cds.taboola.com/?uid=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&src=tfa
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:23 GMT
cache-control
no-store
x-envoy-upstream-service-time
1
Server
nginx
Connection
close
unip
trc.taboola.com/1176195/log/3/ Frame 7F19 		0
88 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1176195/log/3/unip?en=page_view&tim=1591908623087&vi=1591908623081&ri=5ec13e238a2be49f61cf5594432b3e19&sd=v2_92b1b358cae0ded818af46689ab9042d_742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b_1591908623_1591908623_CAQQg-VHGOnFl6mqLiABKAQwKziy0A1A0IgQSPKd3QNQ____________AVgAYABo4qaqkbKtl-Jw&ui=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&ref=N%2FA&cv=20200603-6-RELEASE
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1176195/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:23 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4047-HHN
pragma
no-cache
server
nginx
x-timer
S1591908623.180753,VS0,VE9
content-type
image/gif
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
view
securepubads.g.doubleclick.net/pcs/ Frame A4A5 		0
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvifxPQaqNVMbL6y72K965uKy3Kln0bQvUIl5dzZmLzE73jqNc8c8ZbopcG49GaFQdH4D5hgPSDnH_F7EFxyXxeQWRGoE7PA-XVSGrYzXufYUi2vQd_O7L9as44DYPQsbu9nv8GPkWhh_QruJdBozobqNnraLGOvYJ4KFWsVLPTCW8qJlsSx5ipKmrik9zeB7hA7oq2LCfBrnsDc9EIYlwP36uca-zHWtDeibNuzz3uiPZzh06L4CVeXc8crtDG0Rwhh3-QajnDFl8Ktm3t1H6vAwOG&sai=AMfl-YTX3ZpWHrALAvbPSVqeZcnBsCXL4doGI3nBeOo32dV2ufYU-4UdGQ_9C1hMck7X9tTfxajacu5hncGsCopZPvnrwtHxbgN0uwEO7okh&sig=Cg0ArKJSzP6rjq9EXV9dEAE&urlfix=1&adurl=
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s16-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:23 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:23 GMT
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMG2IBAUkzFFCPAAAoPAx3ABbosAZBAAOA55A55A85B55A58E55A55AGAxyAxyA3yArbosAPKAAeUAKAAHYeNAPAAAoPAx3AHbosAPAAAoPASQAHl5/APtEAAAAAAAKbosAPZJAAAAAAAIbosASksFDBdoPAx3AtEA6DAFAAAbosAAAAAPANlFkpF1tFSlFj0FhuFnsFlBFAAAAAAAAAAAAAAAAQtjF5cbUSA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:23 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:22 GMT
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMH2IBA/k0FSRmvFytFh0FjvFklF9TEr5FzjFyhFwlFyfFx2AwmAhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAyzA53A2zAxmAzpF6lF9xAywA42BwwAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9zEr5FmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEzrF5mBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42Ax5A55A4mEvyFthF0jFvkFl9BNlFkpF1tFSlFj0FhuFnsFlmBhkF29By5A53A21Az1AmjEwpFk9BklFzrF0vFwmBhwFh9B1zA35A40A22AwwAmjEpkF9xAz4AzxAy0Ax2Ay0A0mAzpF6lF9zAwwA4yB1wAmzEp0Fl9BkpFzwFfjF0jFfnFvsFltFukElfFzkFmwEshFjlF9hEy0FprFlsFmhEwiF9yEljF0hFunFslFmhEwjF91Az3A54A02A2wAwmAhwFk9B1zA35A40A22AwwAmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEylFj0FhuFnsFlmBhkFj9BkpFylFj0FmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42AywAwxA3mEvyFthF0jFvkFl9BNlFkpF1tFSlFj0FhuFnsFlmBhkF29B25Aw1Ax1A13A1mAjwFpkF9kElzFr0FvwFmhEwhF90A44A54AwxAy0A3mAjpFk9BxzA4yA23A43Ay2A3xAmzEp6Fl9BzwAx4Ey1AwmAzpF0lF9kEpzFwfFj0FjfFnvFslFtuBklFfzFkmBwsFhjFl9BhyF0pFrlFsmBhwFi9BylFj0FhuFnsFlyBmhEwjF90A44A54AwxAy0A3mAhwFk9B04A45A4wAxyA03AmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEylFj0FhuFnsFlyBmhEkjF9BEkYFtZEplFskFsvF2lFmtEtvFklF9kElmFh1Fs0FmjEi9Bx1A5xA5wA42AywAw4A3mEvyFthF0jFvkFl9BCpFssFivFhyFkmBhkF29B25Aw1Ax1A13A1mAjwFpkF9kElzFr0FvwFmhEwhF90A00Az3A33A52A4mAjpFk9BxzA4zAwyAy1A3wA44AmzEp6Fl9B53Aw4Ey1AwmAzpF0lF9kEpzFwfFj0FjfFnvFslFtuBklFfzFkmBwsFhjFl9BhyF0pFrlFsmBhwFi9BihFuuFlyFmhEwjF90A00Az3A33A52A4mAhwFk9B00A0zA33A35A24AmhEwlF9lAyGE00A00AlyAGkFpzFwfFj0FjfFnvFslFtuBklFfzFklByGEhyF0pFrlFslByGEihFuuFlyFmhEkjF9hEkmFvyFtmBttFvkFl9BklFmhF1sF0mBjiF9xA15Ax5Aw4A2yAz0Az4ATkzFARksFAQtjFtMScZA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:23 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:22 GMT
adscaleSyncDone
tracking.m6r.eu/sync/
Redirect Chain
  • https://ih.adscale.de/adscale-ih/tpui?tpid=48&tpuid=c6b9bef103290bcdf474865cd02fd97c&cburl=https%3A%2F%2Ftracking.m6r.eu%2Fsync%2FadscaleSyncDone%3FuserBuyeruid%3Dc6b9bef103290bcdf474865cd02fd97c%2...
  • https://ih.adscale.de/adscale-ih/tpui?tpid=48&tpuid=c6b9bef103290bcdf474865cd02fd97c&cburl=https%3A%2F%2Ftracking.m6r.eu%2Fsync%2FadscaleSyncDone%3FuserBuyeruid%3Dc6b9bef103290bcdf474865cd02fd97c%2...
  • https://tracking.m6r.eu/sync/adscaleSyncDone?userBuyeruid=c6b9bef103290bcdf474865cd02fd97c&userId=adscale-user:a39cc0bb59688e1c529e32fb942f44bc2d161a2e67e787dafce9b543670172b0
44 B
574 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tracking.m6r.eu/sync/adscaleSyncDone?userBuyeruid=c6b9bef103290bcdf474865cd02fd97c&userId=adscale-user:a39cc0bb59688e1c529e32fb942f44bc2d161a2e67e787dafce9b543670172b0
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.56.30.78 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-56-30-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
821e2efd660f6b759d561cd5cd194670e51ecebcbc06055cdcbebcd91ec94a56

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:24 GMT
Cache-Control
no-cache
Server
nginx
Connection
keep-alive
Content-Type
image/gif
Content-Length
44
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

status
307
date
Thu, 11 Jun 2020 20:50:23 GMT
server
Apache-Coyote/1.1
content-length
0
location
https://tracking.m6r.eu/sync/adscaleSyncDone?userBuyeruid=c6b9bef103290bcdf474865cd02fd97c&userId=adscale-user:a39cc0bb59688e1c529e32fb942f44bc2d161a2e67e787dafce9b543670172b0
p3p
CP=NOI PSA OUR
bounce
ib.adnxs.com/
Redirect Chain
  • https://tracking.m6r.eu/sync/appnexusRedirect
  • https://ib.adnxs.com/setuid?entity=197&code=c6b9bef103290bcdf474865cd02fd97c
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D197%26code%3Dc6b9bef103290bcdf474865cd02fd97c
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D197%26code%3Dc6b9bef103290bcdf474865cd02fd97c
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:26 GMT
X-Proxy-Origin
185.236.201.148; 185.236.201.148; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.74:80
AN-X-Request-Uuid
99676056-cd52-4101-8483-1c4ec6099686
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:26 GMT
X-Proxy-Origin
185.236.201.148; 185.236.201.148; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.251:80
AN-X-Request-Uuid
5d86a6d8-1340-4c76-a0fc-e9864793bd7d
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D197%26code%3Dc6b9bef103290bcdf474865cd02fd97c
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
adxSyncDone
tracking.m6r.eu/sync/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xrm-8QMpC830dIZc0C_ZfA
  • https://tracking.m6r.eu/sync/adxSyncDone?google_ula=158217889,0
44 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tracking.m6r.eu/sync/adxSyncDone?google_ula=158217889,0
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.56.30.78 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-56-30-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
821e2efd660f6b759d561cd5cd194670e51ecebcbc06055cdcbebcd91ec94a56

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:24 GMT
Cache-Control
no-cache
Server
nginx
Connection
keep-alive
Content-Type
image/gif
Content-Length
44
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:23 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://tracking.m6r.eu/sync/adxSyncDone?google_ula=158217889,0
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
260
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
m
ad.yieldlab.net/
Redirect Chain
  • https://tracking.m6r.eu/sync/yieldlabRedirect
  • https://ad.yieldlab.net/m?dt_id=36356&ext_id=c6b9bef103290bcdf474865cd02fd97c
0
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.yieldlab.net/m?dt_id=36356&ext_id=c6b9bef103290bcdf474865cd02fd97c
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.63.115.52 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-63-115-52.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:24 GMT
x-content-type-options
nosniff
x-frame-options
DENY
Cache-Control
no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection
keep-alive
x-xss-protection
1; mode=block
x-application-context
application
Expires
Wed, 10 Jun 2020 20:50:24 GMT

Redirect headers

Location
https://ad.yieldlab.net/m?dt_id=36356&ext_id=c6b9bef103290bcdf474865cd02fd97c
Date
Thu, 11 Jun 2020 20:50:23 GMT
Server
nginx
Connection
keep-alive
Content-Type
text/plain; charset=utf-8
Content-Length
99
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
data
lb52.s400.meetrics.net/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lb52.s400.meetrics.net/data?/5yiMIROBALlnFEUkzFnBPHmAAAAAAABICWAPAAAFAAICWTTfPAPAAA7EAMCABTfPAZAAAOA55A55A85B55A58E55A55AFA5wAy0A4BErTfPAPMEA7EAMCAHTfPASksFeFjAAAAAAAAAAAAEAAAICWAAAAAAAHAklFzrF0vFwBFHAhyF0pFrlFsBFUAkpFzwFfjF0jFfnFvsFltFukElfFzkFHA53Aw4Ey1AwBEMAxzA4zAwyAy1A3wA44AGAhkFmvFytFAAAAJA25Aw1Ax1A13A1BEKA00A0zA33A35A24AGAihFuuFlyFKA00A0zA33A35A24AKA00A0zA33A35A24AxAlyAG0B00A0lAyGEkpFzwFfjF0jFfnFvsFltFukElfFzkFlyAGhFy0FprFlsFlyAGiFhuFulFyBFd7EAMCAKPA6DAFAAATfPAAAAAJACpFssFivFhyFkBFAAAAAAAAAAAAAAAAQtjF62svSA
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.33.79 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h380.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:23 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Thu, 11-Jun-20 20:50:22 GMT
/
track.adform.net/serving/unload/ Frame A4A5 		35 B
458 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&pud=x0pZ4Gg4NBJZ14kZ6X9y-n7M4IVOMQ1Ux9_c50Tg4YBf6iTYkFZRmGYwTX9OPQaJU3DZqmTKonISJHim79mr5AhjzLweelGo3a0ffpGsn709y3RUtZaPVgKFeNM9cx20InS5CUv4JCC7S53CtmwtvAlOvwb8ni9npKED6AeOgVz4turQaHXwCvH84ZZpUMZ4__We29M9C4hKPBru5u4CnKILB6ORybfc0&unload=-7884115242941919908@@37314282,5883793559325451005,100|1070|0|0|0|0|0|0|0||135|0|716|a2211b37807a4946a0559ae430241d05-1-716_e1bd04bd995b406284a7fa8b15c5b45c|||1|0|0|XNOIPbvJ5VLS-u9nRnEYZVY5KbNYHVQW7b9y4oZD8uUr9bv4QRq4IgCGNAPpKNgC_xQboQRki9Q1|gUoXqwTN3hwqHMLsI0XOHeO4u2dm-xD42vCrke-JUqrkME5qZYz69JT7WXJg35mTODx6rrQFgqn016pXAhp9_otU5BUI9NmBNKHiCZznyHREb6-yJz-dccJsgjtHD2ClicLsf7NCBqQ7k6MeQj2eFIs0gQ2d59t8BKvpZU1usEAgZwFsQhj5y_clRRPV2mvrEGoxcG7oO8V_FfTELfLoXsWjAexNyLOV0|1|11|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:24 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
/
track.adform.net/serving/unload/ Frame A4A5 		35 B
467 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-7884115242941919908@@37314282,5883793559325451005,100|1071|0|0|0|0|0|0|0||135|0|716|a2211b37807a4946a0559ae430241d05-1-716_e1bd04bd995b406284a7fa8b15c5b45c|||1|0|0|XNOIPbvJ5VLS-u9nRnEYZVY5KbNYHVQW7b9y4oZD8uUr9bv4QRq4IgCGNAPpKNgC_xQboQRki9Q1|gUoXqwTN3hwqHMLsI0XOHeO4u2dm-xD42vCrke-JUqrkME5qZYz69JT7WXJg35mTODx6rrQFgqn016pXAhp9_otU5BUI9NmBNKHiCZznyHREb6-yJz-dccJsgjtHD2ClicLsf7NCBqQ7k6MeQj2eFIs0gQ2d59t8BKvpZU1usEAgZwFsQhj5y_clRRPV2mvrEGoxcG7oO8V_FfTELfLoXsWjAexNyLOV0|1|01|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:24 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
/
track.adform.net/Serving/Event/ Frame A4A5 		35 B
303 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.adform.net/Serving/Event/?bn=37314282&event=178&time=4&baid=38435707&name=Viewable%20impressions&imprid=5883793559325451005&icid=-7884115242941919908&eData=kixzCzMabHz6JjLE5HGfS0JIMl4SB92H47q5RJUOSALpIRILj6nZcxjBAqD3hRKEc3lwsVNuu1HQnU0Y1DaIvA2&adxvars=gUoXqwTN3hwqHMLsI0XOHeO4u2dm-xD42vCrke-JUqrkME5qZYz69JT7WXJg35mTODx6rrQFgqn016pXAhp9_otU5BUI9NmBNKHiCZznyHREb6-yJz-dccJsgjtHD2ClicLsf7NCBqQ7k6MeQj2eFIs0gQ2d59t8BKvpZU1usEAgZwFsQhj5y_clRRPV2mvrEGoxcG7oO8V_FfTELfLoXsWjAexNyLOV0&rtbdata=JPGycFPkrab-19wAZZxJ49JfP3_vJfaSPlQ7yZqqpTYCkqoxQQ0LwX9maskjoNZGrv1nC1ieZ6aKuM-ONkmISoyKgjuEy_PKuwkUe6ZRBvzZWr7MyfyxSaBCPpn20DTfgzFI_SUttAh0ZVvp_XnOL_DzRaZIo8kBv8ZfjLYyVsDYw1c9iLtcmhC4SBQUStfXxiKMLPUI_THwoGO4P1O6JE5dZH4SwUiF3DjLPH8oxJ02cYzUbv2Fv9Zjhti-vfXn5DK_DrA1i0Gltwe0vSv7Ig2U6eRnBA0fkxUvuCqDgZdxBQXPqCWJ2weEPpqPT96QOSIteHR7i5iFvM6Z82c3G26dVCpEniDSeihy17cMAys1&rtbwp=kDNm5u9Om2IF_XFtgcSMvqdgnaMU4Hum0&rnd=614544378
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:24 GMT
server
nginx
status
200
strict-transport-security
max-age=31536000; includeSubDomains
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-type
image/gif
expires
-1
activeview
pagead2.googlesyndication.com/pcs/ Frame A4A5 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssHyqEN_cCjfDC5y83fBgD9jVeaOrWSLbp0XlVQjlYRFvvjS8iPWV-6OIfP0do3viy43J7thkX8RBPIGqydiSs5ig3sovGcPOYOKYW8tfQ&sig=Cg0ArKJSzOH8QOpiN_PKEAE&adk=494505520&tt=-1&bs=1600%2C1200&mtos=1062,1062,1062,1062,1062&tos=1062,0,0,0,0&p=140,315,390,1285&mcvt=1062&rs=3&ht=0&tfs=2714&tls=3845&mc=1&lte=1&bas=0&bac=0&met=ie&la=1&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1591908619923&dlt&rpt=801&isd=0&msd=0&ext&xdi=0&ps=1600%2C5317&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-2-11-11-0-0-0&tvt=3844&is=970%2C250&iframe_loc=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200610
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
unip
trc.taboola.com/1176195/log/3/ Frame 7F19 		0
203 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1176195/log/3/unip?en=pre_d_eng_tb&tos=1502&scd=100&ssd=1&est=1591908623085&ver=27&isls=true&src=i&invt=1500&tim=1591908624587&vi=1591908623081&ri=5ec13e238a2be49f61cf5594432b3e19&sd=v2_92b1b358cae0ded818af46689ab9042d_742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b_1591908623_1591908623_CAQQg-VHGOnFl6mqLiABKAQwKziy0A1A0IgQSPKd3QNQ____________AVgAYABo4qaqkbKtl-Jw&ui=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&ref=N%2FA&cv=20200603-6-RELEASE
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1176195/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:24 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4047-HHN
pragma
no-cache
server
nginx
x-timer
S1591908625.597156,VS0,VE9
content-type
image/gif
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
pixel
tracking.m6r.eu/consent/ 		44 B
209 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tracking.m6r.eu/consent/pixel?nocookie=true&nosync=true&consent=true
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.56.30.78 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-56-30-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
821e2efd660f6b759d561cd5cd194670e51ecebcbc06055cdcbebcd91ec94a56

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:25 GMT
Cache-Control
no-cache
Server
nginx
Connection
keep-alive
Content-Length
44
Content-Type
image/gif
/
track.adform.net/serving/unload/ Frame A4A5 		35 B
467 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-7884115242941919908@@37314282,5883793559325451005,100|2969|0|0|0|0|0|0|0||375|0|716|a2211b37807a4946a0559ae430241d05-1-716_e1bd04bd995b406284a7fa8b15c5b45c|||1|0|0|XNOIPbvJ5VLS-u9nRnEYZVY5KbNYHVQW7b9y4oZD8uUr9bv4QRq4IgCGNAPpKNgC_xQboQRki9Q1|gUoXqwTN3hwqHMLsI0XOHeO4u2dm-xD42vCrke-JUqrkME5qZYz69JT7WXJg35mTODx6rrQFgqn016pXAhp9_otU5BUI9NmBNKHiCZznyHREb6-yJz-dccJsgjtHD2ClicLsf7NCBqQ7k6MeQj2eFIs0gQ2d59t8BKvpZU1usEAgZwFsQhj5y_clRRPV2mvrEGoxcG7oO8V_FfTELfLoXsWjAexNyLOV0|1|01|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:26 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
unip
trc.taboola.com/1176195/log/3/ Frame 7F19 		0
219 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1176195/log/3/unip?en=pre_d_eng_tb&tos=4503&scd=100&ssd=1&est=1591908623085&ver=27&isls=true&src=i&invt=3000&tim=1591908627588&vi=1591908623081&ri=5ec13e238a2be49f61cf5594432b3e19&sd=v2_92b1b358cae0ded818af46689ab9042d_742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b_1591908623_1591908623_CAQQg-VHGOnFl6mqLiABKAQwKziy0A1A0IgQSPKd3QNQ____________AVgAYABo4qaqkbKtl-Jw&ui=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&ref=N%2FA&cv=20200603-6-RELEASE
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1176195/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Thu, 11 Jun 2020 20:50:27 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4047-HHN
pragma
no-cache
server
nginx
x-timer
S1591908628.597539,VS0,VE9
content-type
image/gif
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
perf
trc-events.taboola.com/stroeer-golemde/log/3/ 		0
422 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/stroeer-golemde/log/3/perf?route=AM%3AAM%3AV&lti=block_fast_clicks_2_varC
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:28 GMT
server
nginx
x-fastly-to-nlb-rtt
21446
status
204
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
tbl-x-upstream
10.41.32.36:10213
/
tt.onthe.io/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/?k[]=43098:time[url:%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html,type_article:shortread,article_layout:default,site_skin:desktop,device:desktop,custom_page_type:Article%20page,cdn_version:9]&s=6acc7c777cce3be138a245218c439c54&1591908629037
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:29 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		7 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200602&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7c901d6206006529810620354e711987d31fb05d7da54a60caaacc63eb7b9162
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 11 Jun 2020 20:50:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
5617
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200602/r20190131/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Thu, 11 Jun 2020 20:50:31 GMT
map.js
js.adscale.de/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adscale.de/map.js
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.63.149.97 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-63-149-97.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
150c529eac16aa92021255529157da540cb6e71726348fcc610cc9a059e57422

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
acSVXU2XIRHFVnUIT1gqheyyv3V9rnA8
Content-Encoding
gzip
Last-Modified
Tue, 09 Jun 2020 02:05:04 GMT
Server
AmazonS3
x-amz-request-id
28E39822C79B96B0
ETag
"80afcb3314d9e064a4c39b9808c15298"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=300
Date
Thu, 11 Jun 2020 20:50:31 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3179
x-amz-id-2
eA0A43Lrz3W86dj2O8seGHPIJG3Fg2nGshPuWUbGR+cDEnc2kl/AVt6Py9VAzJDE17leq2kGxoI=
adex.js
dmp.theadex.com/d/285/5184/s/ 		39 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dmp.theadex.com/d/285/5184/s/adex.js?ts=42400964
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.159.106 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software
nginx /
Resource Hash
5318e6f99439de8be22212f030c069a25e38feb81952f4fed93121eed1aef3b4

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:31 GMT
content-encoding
gzip
last-modified
Thu, 16 Jan 2020 08:30:04 GMT
server
nginx
etag
W/"5e201f0c-9d13"
content-type
application/javascript
status
200
cache-control
max-age=300
access-control-allow-credentials
true
expires
Thu, 11 Jun 2020 20:55:31 GMT
ibb_map.js
bbcdn-bbnaut.ibillboard.com/library/ 		0
316 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bbcdn-bbnaut.ibillboard.com/library/ibb_map.js
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
62.168.44.118 Prague, Czech Republic, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
cdn2.bbmedia.cz
Software
ibillboard /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 11 Jun 2020 20:50:32 GMT
Last-Modified
Thu, 27 Feb 2020 10:46:12 GMT
Server
ibillboard
ETag
"5e579df4-0"
Content-Type
application/javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
Expires
Thu, 18 Jun 2020 11:48:50 GMT
default.js
ups.xplosion.de/loader/69511/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ups.xplosion.de/loader/69511/default.js
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.188.151 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-188-151.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
d2f2ba98cc0d598ab0d6927280997816b17db25f0829584f2febdf283466f574

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 11 Jun 2020 20:50:31 GMT
cache-control
must-revalidate,no-cache,no-store
access-control-allow-origin
*
content-type
text/javascript
content-length
1711
p3p
CP="NOI DSP COR NID PSAo OUR SAMo BUS"
tag.js
js.agkn.com/prod/v0/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.agkn.com/prod/v0/tag.js
Requested by
Host: cdn.stroeerdigitalgroup.de
URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:5a00:15:efbc:e300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dc82de33871a9ed40a5379ed264dd0456d9bf58839286b913231648f527bc72b

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 10:27:27 GMT
via
1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
last-modified
Tue, 22 Oct 2019 20:22:52 GMT
server
AmazonS3
age
37385
etag
"f53f55cbab099be3a970b446a66c496a"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
3167
x-amz-cf-id
U1PWuvrAyjy_4-RYfCbr3sMyaw2C0_YumY8XsW2pTsHiCJ_kRAH_Qg==
learn
de-gmtdmp.mookie1.com/t/v2/ 		43 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://de-gmtdmp.mookie1.com/t/v2/learn?tagid=V2_343&src.rand=39265855&src.id=Stroeer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.238.175 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
175.238.186.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:31 GMT
via
1.1 google
server
Apache
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif;charset=UTF-8
alt-svc
clear
content-length
43
x-application-context
application
expires
Thu, 01 Jan 1970 00:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame BFF0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Thu, 11 Jun 2020 20:21:01 GMT
expires
Fri, 11 Jun 2021 20:21:01 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1770
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
t.js
dmp.theadex.com/d/7836/d/ 		73 B
353 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmp.theadex.com/d/7836/d/t.js
Requested by
Host: dmp.theadex.com
URL: https://dmp.theadex.com/d/285/5184/s/adex.js?ts=42400964
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.159.106 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software
nginx /
Resource Hash
3a7b7f6be6f2494527a00fcf77a7e0c9c3d7e7a2788506385122535905eeb01e

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:31 GMT
server
nginx
p3p
CP="CAO PSAa PSDa IVAa IVDa OUR UNI COM NAV"
status
200
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
application/javascript
content-length
73
expires
0
/
dmp.theadex.com/r/285/5184/ Frame A2FF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://dmp.theadex.com/r/285/5184/?c=4229047847458823986
Requested by
Host: dmp.theadex.com
URL: https://dmp.theadex.com/d/285/5184/s/adex.js?ts=42400964
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.159.106 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
dmp.theadex.com
:scheme
https
:path
/r/285/5184/?c=4229047847458823986
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
axd=4229047847458823986
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
server
nginx
date
Thu, 11 Jun 2020 20:50:31 GMT
content-type
text/html; charset=UTF-8
p3p
CP="CAO PSA OUR"
access-control-allow-credentials
true
content-encoding
gzip
gen_204
pagead2.googlesyndication.com/pagead/ 		0
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gda_r20200602&jk=4293903088508887&bg=!nZ6lnoZYRXGEWWkf2RACAAAARFIAAAAPmQF04EE9BFsS3hwPBup_q0P_aVRv8ecDCp4C2IQvMxIESOk71CLRirr5NI5RKYbqJu-qijjPGbNz_LvuU_q9qh45yZARUTf9ZZiSAuOXAHXxy2-FeGkOGMIF3nKgLS7iqb8yb4ChReP44ger2kq3UJSxdxPov9DUXN0it8DQRQ-nDQeX2Hd4B9M2burohC6Fca0x-7zrMRPgfrw6m9CooWc38SIpKFL7XMNxHAe6RX_RBTU09lluAnWwb0hU-H6TSjtFPXGs5wDZfm4ZVvIIfHYriEvZsmsBweC6grXiN1PWx25acOGoNM3I9G1deKTiL53yjbp83VXKy9y-YhgSLdy0bVwhWOX6beMLrRSJ7jJ4Hm2CZ6EV4Zdhu4TF6xEa2dJm47NZ5Ba-KS1R3L2UQiLKMegm3eivy6oc_4uNc4ctxbokYwEZjLWzcqmTTs4YUPOZQnZnQ1wX1yOW7EhMHQ9yrTu4BX49SLEy_FsGNUplZHeFghUk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
launcher.js
sak.userreport.com/sdm/ 		64 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sak.userreport.com/sdm/launcher.js
Requested by
Host: nugmw.userreport.com
URL: https://nugmw.userreport.com/rc-ap/6b8079a6-e02e-4bcf-9ba9-1c89fe5d962f/si.nuggad.net/nuggad?nuggn=571289945&nuggsid=1029839715
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.87.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-60.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4a7315598045b0762a4a7c6f40fb6c0da236c402566d27a8ab70db5d8cbb7a58

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
GWFVIbVrEULGta0P7hxp6E817LeR6Zwy
content-encoding
gzip
last-modified
Mon, 18 May 2020 09:31:22 GMT
server
AmazonS3
age
44
date
Thu, 11 Jun 2020 20:49:47 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=7200, s-maxage=60
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
Fp1lX5Zq0mJCMtWk3UVxQVVTxdUg6FEwL-WrQBX3uXxaMRyXfax38A==
via
1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
server.html
tag.userreport.com/ Frame 897E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tag.userreport.com/server.html
Requested by
Host: sak.userreport.com
URL: https://sak.userreport.com/sdm/launcher.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:e400:11:af01:b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash

Request headers

:method
GET
:authority
tag.userreport.com
:scheme
https
:path
/server.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__bpn_uid=dbd0dec8-4c90-4505-b6dd-7edd1f3359c2; __ur_dc=1591908631948
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
content-type
text/html
server
nginx/1.12.2
last-modified
Tue, 14 Apr 2020 13:55:12 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-encoding
gzip
date
Thu, 11 Jun 2020 20:00:02 GMT
cache-control
max-age=3600
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
t33ep0jC1SYg7TTBbmdqR4iCMSpvKwQVEjc66S9V4kbxT7t1qOpjnw==
age
3034
p.min.js
cdn.emetriq.de/adp/profiling/0.2.29/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.emetriq.de/adp/profiling/0.2.29/p.min.js
Requested by
Host: ups.xplosion.de
URL: https://ups.xplosion.de/loader/69511/default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:fa00:1c:8c89:a300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ee768ad3982e5e12922304e31fda4c063a2ba1ab1e86a186a42d68b7623d51d3

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 10 Jun 2020 06:30:45 GMT
content-encoding
gzip
last-modified
Wed, 10 Jun 2020 06:11:51 GMT
server
AmazonS3
age
137988
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
Jtj5CoKyt7v0vNdgyu.jt.3XO9qhTsTm
status
200
cache-control
max-age=31536000, no-transform, public
x-amz-cf-pop
FRA2-C1
content-type
application/javascript; charset=utf-8
x-amz-cf-id
AX0W0UO-SZvqbO9A5M0rAC28C4aVdihNgSXyP_1EfhHgcLWFFxaGKw==
via
1.1 c2a926ef1bafe1ab239d4761594a8099.cloudfront.net (CloudFront)
/
d.agkn.com/iframe/8613/ Frame C443 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://d.agkn.com/iframe/8613/?che=910636559&gdpr=&gdpr_consent=&ref=&bpid=stroeer&c=%7B%22bpid%22%3A%22stroeer%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Requested by
Host: js.agkn.com
URL: https://js.agkn.com/prod/v0/tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:bc00:19:fc2c:a140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash

Request headers

:method
GET
:authority
d.agkn.com
:scheme
https
:path
/iframe/8613/?che=910636559&gdpr=&gdpr_consent=&ref=&bpid=stroeer&c=%7B%22bpid%22%3A%22stroeer%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

status
200
content-type
text/html;charset=UTF-8
content-length
481
cache-control
no-cache, must-revalidate
date
Thu, 11 Jun 2020 20:50:31 GMT
expires
Sat, 01 Jan 2000 00:00:00 GMT
p3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pragma
no-cache
server
Apache-Coyote/1.1
set-cookie
ab=0001%3AWMITl%2B%2F%2Fog6lqnjZHX8b6oTJHj5pMkGF;Path=/;Domain=agkn.com;Max-Age=31536000;SameSite=None;Secure u=C|0AEAmdVWYJnVVmAAAAAAAAg1RAQCADVIBAIA;Path=/;Domain=agkn.com;Max-Age=31536000;SameSite=None;Secure
x-cache
Miss from cloudfront
via
1.1 f046bfa1468bb4385e357c8c9128cf51.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
n7paCeIYHDk6fSTC9PduNhgE0bRGUn7uAQjsh_TO9oAAbgm90g1a7g==
data
ups.xplosion.de/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ups.xplosion.de/data?title=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&hostSiteUrl=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&userAgent=5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36&userLang=en-US&color=24&os=Linux%20x86_64&timezone=-2&screen=1200x1600&mbr=c6b9bef103290bcdf474865cd02fd97c&event_id=page_view&gdpr=&gdpr_consent=&gdpr_success=0&_sid=69511&_ver=0.2.29&_seg=jsonp&_=106675877467
Requested by
Host: cdn.emetriq.de
URL: https://cdn.emetriq.de/adp/profiling/0.2.29/p.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.188.151 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-188-151.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
00e55928cc2411c7cd9b0bf3995a8d03c14b72d554e2243ea9cd2a2123c03fb4

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 11 Jun 2020 20:50:32 GMT
content-encoding
gzip
status
200
vary
accept-encoding
p3p
CP="NOI DSP COR NID PSAo OUR SAMo BUS"
access-control-allow-origin
*
cache-control
must-revalidate,no-cache,no-store
content-type
text/javascript
adrtxtag.min.js
cdn.adrtx.net/ 		840 B
849 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adrtx.net/adrtxtag.min.js
Requested by
Host: www.golem.de
URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.253.51.81 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-253-51-81.eu-west-1.compute.amazonaws.com
Software
akka-http/10.1.11 /
Resource Hash
760e4b5d62fd40555e5378e6216c0d4bec64c26bd39d3418b59e14c46ad0aa08

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 10 Jun 2020 06:11:59 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Jun 2020 06:11:59 GMT
Server
akka-http/10.1.11
ETag
"8fda08a34733677008755479a59fa669"
Content-Type
application/javascript; charset=UTF-8
Cache-Control
max-age=86400, must-revalidate
Connection
keep-alive
Content-Length
509
activation
adstax-match.adrtx.net/ Frame A23E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://adstax-match.adrtx.net/activation?receiverId=adaud
Requested by
Host: cdn.adrtx.net
URL: https://cdn.adrtx.net/adrtxtag.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.91.228 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-91-228.eu-west-1.compute.amazonaws.com
Software
akka-http/10.1.11 /
Resource Hash

Request headers

Host
adstax-match.adrtx.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=UTF-8
Date
Thu, 11 Jun 2020 20:50:32 GMT
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server
akka-http/10.1.11
X-Error-Reason
Missing UserId
Content-Length
39
Connection
keep-alive
1.gif
dmp.theadex.com/d/285/5184/i/ 		36 B
307 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmp.theadex.com/d/285/5184/i/1.gif?c=4229047847458823986&t=1&location=https%3A%2F%2Fwww.golem.de%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html&protocol=https%3A%2F%2F&tzo=-120&date=1591908631&sw=1600&sh=1200&sd=24&pd=24&saw=1600&sah=1200&vw=1600&vh=1200&pmd=Der%20Medizinkonzern%20teilt%20mit%2C%20dass%20die%20Patientenversorgung%20nicht%20gef%C3%A4hrdet%20ist.&pmt=Ransomware%3A%20Schadsoftware%20beeintr%C3%A4chtigt%20Produktion%20bei%20Fresenius%20-%20Golem.de&csource=8&r=9c7ef24da30bb10edf6b7f38c8be63fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.159.106 Cloppenburg, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software
nginx /
Resource Hash
204265a6f1fc8529e4a64cff2c17c04709b46455f93003d24edb50bd78977223

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:32 GMT
server
nginx
p3p
CP="CAO PSAa PSDa IVAa IVDa OUR UNI COM NAV"
status
200
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
content-length
36
expires
0
unip
trc.taboola.com/1176195/log/3/ Frame 7F19 		0
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1176195/log/3/unip?en=pre_d_eng_tb&tos=10503&scd=100&ssd=1&est=1591908623085&ver=27&isls=true&src=i&invt=6000&tim=1591908633588&vi=1591908623081&ri=5ec13e238a2be49f61cf5594432b3e19&sd=v2_92b1b358cae0ded818af46689ab9042d_742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b_1591908623_1591908623_CAQQg-VHGOnFl6mqLiABKAQwKziy0A1A0IgQSPKd3QNQ____________AVgAYABo4qaqkbKtl-Jw&ui=742d1769-2baf-4a6d-b6e2-914a1efb08ff-tuct5dc1e8b&ref=N%2FA&cv=20200603-6-RELEASE
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1176195/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
10
date
Thu, 11 Jun 2020 20:50:33 GMT
via
1.1 varnish
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
x-served-by
cache-hhn4047-HHN
pragma
no-cache
server
nginx
x-timer
S1591908634.598091,VS0,VE10
content-type
image/gif
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
perf
trc-events.taboola.com/stroeer-golemde/log/3/ 		0
422 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/stroeer-golemde/log/3/perf?route=AM%3AAM%3AV&lti=block_fast_clicks_2_varC
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200604-21_b1-PR-26830-DEV-67276-apply-blocking-on-too-fast-oc-clicks-f8df3bd800c-SNAPSHOT.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 11 Jun 2020 20:50:38 GMT
server
nginx
x-fastly-to-nlb-rtt
21074
status
204
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.golem.de
cache-control
no-cache
access-control-allow-credentials
true
tbl-x-upstream
10.40.0.117:10213
/
tt.onthe.io/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tt.onthe.io/?k[]=43098:time[url:%2Fnews%2Fransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html,type_article:shortread,article_layout:default,site_skin:desktop,device:desktop,custom_page_type:Article%20page,cdn_version:9]&s=6acc7c777cce3be138a245218c439c54&1591908639035
Requested by
Host: cdn.onthe.io
URL: https://cdn.onthe.io/io.js/IjvnOpbzskTW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.216.24.148 , Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.148.24.216.95.clients.your-server.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jun 2020 20:50:39 GMT
Server
nginx
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:01 GMT

Verdicts & Comments Add Verdict or Comment

191 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| Golem object| _gcpx string| _rngnafc boolean| _rngnaf string| gafc_rubrik string| gafc_zone number| ord function| $ function| jQuery string| IVW object| _gafccsi function| getSDG object| SDG function| showSdgDebug object| googletag object| pbjsYLHH boolean| yieldlove_prevent_autoload string| sdgMeetricsStatus object| _enqAdpParam boolean| _golem_html5ads_enable string| showAds function| _onSocialClick object| _taboola object| BigScreen function| golemAcceptCookies object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| YLHH object| yieldlove_site_settings object| confiant object| yieldlove_cmd function| pbjsYLHHChunk object| _pbjsGlobals object| Criteo object| stroeerCore boolean| deliveringAds boolean| subDomainCheckVar boolean| ESJ6froXIuESJ6froXIu string| API_KEY function| ESJ6froXIu2nf string| szmvars object| iom object| iam_data string| ioObject function| io object| ioPageArgs object| _io_config string| disableStr function| gtag number| timeSincePageLoad object| dataLayer object| _gaq string| shareUrl object| ___gcfg boolean| ESJ6froXIu boolean| infinite object| adsbygoogle object| TRC object| _tblConsole undefined| msg object| _comscore object| de_meetrics object| referenceWindow object| NUGGjson function| aplauncherExec function| aplauncher string| n_pbt object| OMSVad object| _m6rq number| google_srt object| google_ad_modifications object| google_logging_queue boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad boolean| _gfp_p_ function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| google_t12n_vars function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter number| __google_ad_urls_id object| gaGlobal object| google_tag_manager boolean| apstagLOADED object| apstag object| google_tag_data string| GoogleAnalyticsObject function| ga object| regeneratorRuntime object| __io function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcJSONify function| __trcUnJSONify function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam function| _calculateEventsLength function| _countDOMNodes function| _countNetworkCalls function| _calculateFPS function| _trackVideoLoadLength function| _trackTimeToFirstUnitElement function| _trackTimeToDisplayImpression function| _trackTimeToPlayerCreation function| _hookToSrcProperty function| _trackTimeToFirstWaterfall number| trc_debug_level string| trc_article_id object| TRCImpl number| taboola_view_id object| yieldlove_ab function| udm_ object| ns_p object| COMSCORE function| google_sa_impl object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator object| google_prev_clients object| google_jobrunner object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| gaplugins object| gaData function| __tcfapi function| stroeerCoreConnect function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb function| renderProgressBar string| nam object| Adform boolean| __adform_onload function| ADFReload function| ADFCall function| ADFcall object| criteo_pubtag string| _io_uniques_holing_params number| _m6rApiLoaded object| _m6rOnce number| _m6rContainerLoaded number| measureInterval object| GoogleGcLKhOms function| setUpAgknTag function| _h object| _adexc object| adex object| google_image_requests string| apsrc object| _urq object| audienceProjectLayer object| __sak object| _EQLService object| _EQPScript function| agknTagBuilder object| _agknTag string| _agknTagName object| _agknEchoTag number| _isAgknTagSet object| _EQPService object| _adrtx string| segments object| segmentsArr undefined| result string| _emqstr

12 Cookies

Domain/Path Name / Value
.golem.de/ Name: fdse_LT2SyOBTdo
Value: {"id":"76b4584a-111a-4516-8469-61afcd731c26","propertyId":"LT2SyOBTdo","active":7387,"inactive":7,"idle":7,"events":{},"campaign":{"sessionAdId":null,"sessionSiteId":null,"pageviewAdId":null,"pageviewSiteId":null},"location":{"href":"https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html","host":"www.golem.de","hash":"","pathname":"/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html","port":0,"protocol":"https:","query":{}},"referer":{"href":null,"host":null,"hash":null,"pathname":null,"port":null,"protocol":null,"query":null},"pageViewCount":1,"variables":{}}
.pubmatic.com/ Name: PUBMDCID
Value: 3
.pubmatic.com/ Name: KRTBCOOKIE_336
Value: 5844-1301132895259180640
.pubmatic.com/ Name: SPugT
Value: 1591908631
.golem.de/ Name: fdca_LT2SyOBTdo
Value: {"adId":null,"siteId":null,"timestamp":1591908630433}
.golem.de/ Name: __io_session_id
Value: e63e89bf9.cced5e71c_1591908629037
.doubleclick.net/ Name: IDE
Value: AHWqTUlbUKE0qKwzrqWp-LUDuQeYJV6dRSCqxlZPV6jzTvpdajFw5Tg1McSeC--M
www.golem.de/ Name: __io_lv
Value: 1591908629035
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AAV0UE69xTIAABCnED0Pww&KRTB&22744-AAV0UE69xTIAABCnED0Pww
.golem.de/ Name: __io
Value: 2bc527c41.1230db081_1591908629035
.pubmatic.com/ Name: PugT
Value: 1591908631
.golem.de/ Name: __io_d
Value: 1_3518382531

4 Console Messages

Source Level URL
Text
console-api log URL: https://www.golem.de/staticrl/scripts/golem_main_114-min.js(Line 14)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api log URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js(Line 1)
Message:
SDG: SYSTEM: Starting to load CORS resource: %o https://tracking.m6r.eu/sync/dmp
console-api log URL: https://cdn.stroeerdigitalgroup.de/metatag/live/ctc_golem/metaTag.min.js(Line 1)
Message:
SDG: SYSTEM: Starting to load CORS resource: %o https://s385.mxcdn.net/679600/%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fsky,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fbanner,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Frectangle,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Fposterad,%2F4444%2Fdisp_ctc_golem.de_sd%2Fartikel%2Frectangle2
console-api log URL: https://www.golem.de/news/ransomware-schadsoftware-beeintraechtigt-produktion-bei-fresenius-2005-148302.html(Line 1120)
Message:
next

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

401aed45362298ea2e6087654ef70265.safeframe.googlesyndication.com
42a5e1dcd8b9fdf4787e04106aaf119c.safeframe.googlesyndication.com
a2a-cs.golem.de
a2a-static.golem.de
account.golem.de
acdn.adnxs.com
ad.yieldlab.net
ad4m.at
ad4mat.net
ads.golem.de
ads.pubmatic.com
adservice.google.ch
adservice.google.com
adstax-match.adrtx.net
adx.adform.net
am-sync.taboola.com
ams.creativecdn.com
api.yieldlove-ad-serving.net
as-sec.casalemedia.com
b1sync.zemanta.com
balancer.sitebarad.com
bbcdn-bbnaut.ibillboard.com
bh.contextweb.com
bidder.criteo.com
bttrack.com
c.amazon-adsystem.com
cdn-a.yieldlove.com
cdn.adrtx.net
cdn.districtm.io
cdn.emetriq.de
cdn.m6r.eu
cdn.onthe.io
cdn.stroeerdigitalgroup.de
cdn.taboola.com
cds.taboola.com
clarium.global.ssl.fastly.net
cm.g.doubleclick.net
confiant-integrations.global.ssl.fastly.net
cpx.golem.de
cpxl.golem.de
creativecdn.com
d.agkn.com
de-gmtdmp.mookie1.com
de.ioam.de
dmp.theadex.com
dmx.districtm.io
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
googleads.g.doubleclick.net
gum.criteo.com
hb.adscale.de
hbopenbid.pubmatic.com
ib.adnxs.com
ih.adscale.de
images.taboola.com
io.fusedeck.net
irqs.ioam.de
js-sec.indexww.com
js.adscale.de
js.agkn.com
lb52.s400.meetrics.net
match.adsrvr.org
match.taboola.com
match.zorosrv.com
mug.criteo.com
nugmw.userreport.com
orbidder.otto.de
pagead2.googlesyndication.com
pipe06.sitebarad.com
pixel.rubiconproject.com
prg.smartadserver.com
prod-ingestion.tracking.v2.yieldlove-ad-serving.net
protected-by.clarium.io
px.adhigh.net
px.powerlinks.com
rtb.mfadsrvr.com
s1.adform.net
s385.mxcdn.net
s400.mxcdn.net
sak.userreport.com
sb.scorecardresearch.com
script.ioam.de
securepubads.g.doubleclick.net
si.nuggad.net
simage2.pubmatic.com
ssl-golem.met.vgwort.de
static.criteo.net
stats.g.doubleclick.net
sync.mathtag.com
tag.userreport.com
tpc.googlesyndication.com
track.adform.net
tracking.m6r.eu
trc-events.taboola.com
trc.taboola.com
tt.onthe.io
ups.xplosion.de
video.golem.de
www.golem.de
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.storygize.net
x.bidswitch.net
yieldlove-d.openx.net
104.111.230.142
104.16.68.69
104.96.130.160
13.224.199.29
13.225.87.121
13.225.87.60
136.243.33.79
136.243.75.32
141.226.224.32
141.226.228.48
142.93.100.57
146.148.127.183
151.101.113.194
151.101.113.44
151.101.13.108
151.101.13.44
161.156.66.184
172.217.22.34
176.74.59.146
178.250.0.157
178.250.2.131
18.194.102.89
18.194.230.189
18.196.193.20
184.51.8.201
184.51.9.34
184.51.9.98
185.184.8.30
185.29.132.30
185.33.221.13
185.64.189.112
185.64.190.80
185.86.139.96
192.132.33.46
193.46.63.75
198.148.27.140
216.58.207.66
23.56.30.78
23.63.115.52
23.63.149.97
2600:9000:20eb:3c00:12:6213:9cc0:93a1
2600:9000:20eb:5a00:15:efbc:e300:93a1
2600:9000:20eb:bc00:19:fc2c:a140:93a1
2600:9000:20eb:fa00:1c:8c89:a300:93a1
2600:9000:2156:e400:11:af01:b40:93a1
2600:9000:21f3:f600:1f:a1b:34c0:93a1
2a00:13c8:f5::f:4b3d:148
2a00:13c8:f5::f:4b3d:175
2a00:13c8:f5::f:4b3d:17a
2a00:13c8:f5::f:4b3d:180
2a00:13c8:f5::f:4b3d:181
2a00:13c8:f5::f:4b3d:182
2a00:1450:4001:806::2002
2a00:1450:4001:809::2001
2a00:1450:4001:809::2008
2a00:1450:4001:809::200e
2a00:1450:4001:81a::2001
2a00:1450:4001:81c::2002
2a00:1450:4001:820::2001
2a00:1450:400c:c00::9c
2a02:2638:1::3
2a02:2638::1c
2a02:26f0:10c::5f64:c11b
3.123.131.98
3.124.56.61
34.242.91.228
34.252.71.88
34.253.51.81
34.98.64.218
35.156.5.228
35.186.238.175
35.190.94.1
35.206.134.202
35.244.159.8
37.157.6.236
37.157.6.241
40.113.136.100
44.231.125.220
46.231.207.222
52.18.221.188
52.58.42.46
62.168.44.118
69.173.144.138
69.173.144.140
70.42.32.191
80.74.154.241
89.163.159.106
91.215.103.64
91.215.103.65
95.216.24.148
99.81.188.151
0086c9eeccc3347ecac92f6f6777e32de8f8d0ad7d368d309a6fa6cff066cc2e
00ad99ec679b1f9f487e9efeff19175a6c4ffbbe92ceb3a099362e5d1b41073b
00e55928cc2411c7cd9b0bf3995a8d03c14b72d554e2243ea9cd2a2123c03fb4
039aeb8071cbb8114596777717fee193d820b342a43343bf4dfb365c3ccc1e3d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
052eee8a00286e769927cb9c3a9bee0d19f3c3c0a4fb0b1e51049c87742dbddc
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
09367caa70514803713fced8ee4ac247e1fbefe5fb13502fb24f20b46804d826
0cdfd11eeff2c617a795c4e0404e2c9fe3a200bf0ea64dbde36737a7046e8a26
0dd32080d75e4cb798731cbb29880de81df5d2d18307ebf4f0429a97ed783204
12eab7ed9516d8d3da05af9f6af5f31f280da236929d76b0a135cf7cce47ea82
14a18f72aaee0adaa4dd6f84980b3b6dc8e37988bad2d2b942fa8139d26bb68a
14c912652278a80cde809c24f37f3e86754d820ca7c7b2c409af205de7d22d9a
150c529eac16aa92021255529157da540cb6e71726348fcc610cc9a059e57422
161ccad4494446a9539602ccc4ed9fc685ef6da9394d2743033fc0ef095fb503
166f9390df29e23f9c9c45c50026de3b8ea04605424c6edc8557a3d3e71af7b8
19e152f7eb9ab76c22c7ede546e9e5057142c81d09da3b241dad25f2deb1ca2c
1af86638e13bf09d137304659cfbc7e8ab8140a7dc221147c239a7209cdc39e6
1bfa1be80def9391a95c5f8de71a35425c01ede9e026b544f7709ed7a65df67c
1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1
1da2a218d475472681435d7fd54a0d48b33eafbd620677e84947ae8633d57101
204265a6f1fc8529e4a64cff2c17c04709b46455f93003d24edb50bd78977223
21032c2852ef9ad9113e806ce8f822e07561d7ab4c86c6e91a40c8f06f09635a
2107018c8f7339015b59579b71260b57df3e79174e37f1cf7de4817317b47093
213e1412ca50f1c23ce37f3458999f8b6b7564867795096fc03a214906c400ff
2302ce8cf6307e809a07b5cd6ba8a546381a971b75fcc2971090154eea40c4f9
28996d02ced2278c306838e1241d3219a27187c9f6057923ff3e3b8917afacbe
2abfcd790056afc481c48cd6f8e35b79b3bccf309ff6f2c0dfad0650df73d645
2cfcaead3ad0e286c0e874d373b8d05ae70c957ee7f21d83548097f4d941df48
2d233c1838084b7e804e0e7a887190eeeb356132b1f625c7fa96ed3efd61e8b2
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
310c53f5e78d20fcfe0ac0ab504cf3a0ad6bcd8ce2b7eb54fe1cb5a2fbe81229
334edfbf00ad918aebbf33d4ea9365ce1f41afc3346c9f2ba7edd127d6b30f6c
3370a632ca40f137bba450fd14015d5647f443a6724dca1098652503127b0b72
33a615b30f0b0648a299b0d7e7f57e6c5a1b52cfcc831b3572c1f6ff77c1e2b1
34be5162c1722c179608dbc8914407223f7e908d887eb8bc0885cc30f2e45108
35024940af9885956183e4ed658cec9865084057cf933bcaecbc44178c3598f5
39bb350b848bba90633361b2794bb7557a9059e28b2bd15ca7799ee56610a3d0
3a7b7f6be6f2494527a00fcf77a7e0c9c3d7e7a2788506385122535905eeb01e
3b6010aacc0d5c59c53fce2f1f2c43e62472b75c1add1cbbc40700c9dd339461
3c555769a517ffa3db992c9924e9512eb1c5163d7017bcea42660f9c38bcc0bd
42bb877744c06037d98b964f68c3e5d4794968c0915fef531db5137a39b3b0c5
4327b6188850d45e54074d2c921310d37a337e8051e11d9df0e73b391fdedb43
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4591d0920ce6e3486096cb648c8c8b3ade1acecde9cff30f3b97e01140e6c9d0
483a037c1a64d12b012a708b4c5b88f00991843b190c45cec9824cb6299f1d1c
4843d00895b38e6960ecbce774ae2361a034c47a149088a3865850f90ff319a4
492181ed2b52a8c8cf7fae00505cdff03ed15992e697c2176bf60b854a32edd3
49f6a71a428ca6e61b751b567bb2f92a873d0039e916381a0b8e74ee26508bc5
4a7315598045b0762a4a7c6f40fb6c0da236c402566d27a8ab70db5d8cbb7a58
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c3b5063f24797bc9d18e85486e57fca0435821badf7f1086d069328c4df5356
4d3e1c71d302c1ea7865ebc3d2751eb37c1a32aa0878bd6503cfde624b54c7a9
4e8d6e3b35948e5fb1b6d570acce30f0b1560ed00ec1f300793389f19c967dff
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
50bd5e7886676f4c5bf147334237a55389bbc6828a1b37cc361eefd8a0f7f768
5318e6f99439de8be22212f030c069a25e38feb81952f4fed93121eed1aef3b4
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55e30adb2faf80e59e4a70a75809a573ed0acd7b6fb703bde722bd3ddf56584d
588875574017ece47aada065ca4c0e4d17a99ebd085cc11b4350493e55e215a4
5a698b0e0445a27e77e7e642cb8fe667299382c832b050a1244329b4c952c3ef
5aa0ad9efad49670aabf98a6dc1a8b83d1e2219df1e19548f076fabff1b3cc45
5cf7de40ce05f49081fe1e4271e6cd2eb43fb21aafdd0e69b5078ba9f4d91309
5ea6305227bc5aab4c6cc7760551942da92e29cde1bc5aec40e5edea6a7df974
5fa7033ea8a577c5c20da720503495483dae8bb21b708238c34949f637bfe503
600a0718bc411395294d3af96651470ec26c15c3f0a6ca3b579a523c9098b4ce
61c6055ce70b0f30a656960ac73834ec1c54b5fd195b8abb0cb3fd4ad6ba5ce3
653ecfa4fbb8a0a5085d4eb14fc668c8cd30ff0b51616f7a8032c88d7468ea93
65bebe1c16bdfa07dbf80ad4a2ba009f24d338eed11f483b4fa618d53d318301
68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17
694b75cb023360906b37c9b2b4c6d385c307e20eb38b10db06c50d182cb376c6
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6d62d5829b3adde8fec4b48d4f3f473a2fb2765e22e0d1d0afae1f77dcc56570
71561a3bca82f8abb1c48231b9d1a6500aa76c5f3eb838f2ac1dc0c81c5811ae
71a2d7ee39a1512010d2ae4af01fc763eb460217497aafe78338d4e2818025b8
7281df0fc37f02952ecbff4b9f47640a7f193aac19c97f89e3e276b20d47e454
72ce44d1321e5caeec893cabdf662745ce2d8af68b65665b6e62e5f7bbcd5e0f
7330ad6ba46b33e3f5a87b5e1da9aba23b8bda9e1034a109d0a944c06d1ae362
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
760e4b5d62fd40555e5378e6216c0d4bec64c26bd39d3418b59e14c46ad0aa08
7987f334fa5e927c912da754adb07f762b92a5aa977ae82ac73f86d2aa97496e
798a3de5fe5499327dddc0095cc0e31894969b62084db415c12ffa9faf3eb3ab
7c583ff6dde540cb3e4e03f02a23ea9706c67a247e8e6e21b97f5552583889af
7c901d6206006529810620354e711987d31fb05d7da54a60caaacc63eb7b9162
7ea414cd6f359d94fc9b789865a45cf671e7b754e4f74c68111229a27210e9e5
821e2efd660f6b759d561cd5cd194670e51ecebcbc06055cdcbebcd91ec94a56
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84058f4935f4a903f78426d22151ce5ca07e601bcf127fdc75f316b725be4c40
8453ec595b19e74278586279557ad2ed3ff9e76820a6b4c4eaa81072cbd23200
8a36e599380e655f39c4efed4edac465f40054dd7c042e939bb6d42591b06088
92bc2c43213b90e183b575b92067ecec666b30a739d5fecbc7a4140c794aa09e
96bff9a63428fcafaa40226d7ccf7b90ab5776979db144a62bdef6a7a77d5eec
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9979a8bb08e760486cf14c491d75a0c647bb2e133e3daba53a63132a99f14c1e
9a177a7eb550edc5245271ea26fb341eb424f26b3018059d3d940a0df6bb6d0c
9e08d9b8d1eb5cfb13e10bc6afb3a6f3a40f6ac1f65c6ecd076dc66b7edafb6a
9efa53ec1a261a8576a66a71befaf9d03c1a108aac36271f4599b87597b8a71e
9f4253373ca10d7fa488777a9fe7f09cd06f88d48218047773d7e279b8c68dde
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a369d2dc1c948b59fafe7de8a998b3e9d32894787676e783f158d4be4b2dd1cf
a3ee3dfa0c841ac65f9474ec69cc305561ff88e2719fe9d9032b088ba3f1ce93
a5bca980db62cd62b8af6d7e13a8fca10bcf3275d804a266bac4cd2907e206d2
a9b2305efba696757b3aa33178a213641bf09a7da4819e65442e3a427ee21bce
ab9be1fc54950922c099303b0e849eb33a932e88925f6fbddf2132c6f201de9e
af9cd3bcdb305980a5809663b5612d222b76988988243f74c8c5e59b34ab83ce
b07df8711e488313141e80adadeead6cd6f68c689a43e66fc31f05c0f9252381
b1ccfa95f4ea0882054380eeab8fd6bbe71de91ed756d1e63befcda1b6a77427
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
b388addf9c8ba4bc2852132727bd9df68c99db7ca97d22fdb18ad2a426d02a5b
b3f72e1980ae38c8289cfccb0d408686a4fef3371ae0c90fbb7139bbe2567f13
b421ca0ae38a2c2c3a630a82e36565f7781a9d2c274000d21c2d8e20c1ac660c
b67d56e8da32fd316174c18e3056154cfdbe6029fcc2e15b4318981f075172c1
b70f178dcf05ca92cc0a2fda1482495e278dc6e1cde3b5e656d46bfe935df2ab
b83b19265e1eda8e776d9fe74da535af70df00887914a2d0394ad5da7725c0a8
bb7d3ff46bd6e5be407580dd2839028d44e7f2e0da939253ed19dc95d1f17e39
bf4a3be9dfedb8111a29819e647796daee15c77b69d2074ae63230899b538f18
c0563e7f92c3564af0f9d4cfbce95ed0f34c6e7e0b4c04dd68e4b6628412c458
c0ffbb72a86bc32b7ca6b2960b7b3c736dbef49eaaf13b8a2456e9057e935ead
ca22bbea82c56e0ec68b907bd3099e6bd2ee5211d8d3d07a1f6187a86c828fa8
cd3627cbb4161b54ed6f0edaa6165ab0363caa2f4348b24443e62af10b11dcb1
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d15f979b292dbeac2c7a98a463bff77e9ab869378622c5f3528035713764c7f0
d250260787efed78dd06a1f30ef3503b52ce8271cc22a08b891adaf21eefabc1
d2504a1a9f4ec25b22f33d65c528f1b6547c4798c9a0362d4a539e1eef928bca
d2f2ba98cc0d598ab0d6927280997816b17db25f0829584f2febdf283466f574
d34da2ea21a041db1e9f4b80b0755ab58036714f03204b9c48dd10fe8e728bec
d5ea92e80113829e1cc60cb096ac79b4cf7c30c836991667ca7c6605f181bb13
d79a2c08ec56eb5e1c76ca58af8b280d29c8792641565d3e9983a9ea8f7e9bb6
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc82de33871a9ed40a5379ed264dd0456d9bf58839286b913231648f527bc72b
e07cc9a19848f942ff4ac3c0f4eb082d728f7e0afdd76ede59eb34d36341fab9
e14ed51c90c75e021a73b2762f5d893ba43ffc099c5bfd26834b37759d6d52a0
e2ee3ef901c77ebb143440015f248ffa4bc50c35b6304838b838b2969a02e0f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3bfdfeab19f423e85d1483297516edc86e2e84f0a5029eb72616991d1959166
e4eace64ebe7e74d91a251c1ab70a944613b857ecd9e95c12b5932ba0a5c322a
e5314e6ef0062ff49bdff5e58cdc00ff10ccb14c1a0a5f2d5265c9149740bbff
e72acd75e28308144c191955763a907264b850d4e8e2960d724f273e4934e34d
e94712bd5679e91d66469fac2cbf6322a706e4e8f25fe37c762b8167391a7c2c
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ebd4501ff7638a12e6afb1802e8d2164259435847795d3b520e530be11e91267
ec3943468e660a13879ad7ea484da73199fd5220d765a1163c045294fbc1c546
ec4d67b8d84b3d6dfdb4f753777bfb8606d20b317df2cdd4ab2f707c13642474
ee768ad3982e5e12922304e31fda4c063a2ba1ab1e86a186a42d68b7623d51d3
ef0c05d2d6f69f777642d94ddd573cd4b9916dccd84e7e008d29007a574cee01
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb4cb441012a3c40b61286fb57bb119a94c40ac6b030dcfad742d9be070a9ed
f295eac03c0b136481b110dfc5502885a4e502986f1a33e7136bf70cee3644e5
f2987d36cb67fb5016ce89e21ccfe3cb49d7a571c5ff5acf4f421373ec25a047
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f9df5fc31a4260c9623725a19cb9bb108c09648f000d74e1ee48393479faa718
fea36d00c1bc34db2ad3f25f7a85287aa2f41a54e8836280b9291d8c3c62f6d2
ff8d0cd9b6e1af7e78d6e1c78d2e71bd6c887ec2f83277305d69f8252f6c26d6